Self‑Hosted Bitwarden on Raspberry Pi: 5‑Minute Docker Setup

Want a secure password vault running on your Raspberry Pi without endless trial‑and‑error? This guide walks you through a clean, one‑command Docker install, hardening tips, and automated backups—so you can have a fully functional self‑hosted Bitwarden Raspberry Pi up and running in minutes.

Why most DIY attempts fail (and how to avoid the chaos)

Beginners often copy random snippets, mix different Docker images, and end up with containers that won’t start. The main culprits are:

• Using an x86 image on an ARM‑based Pi.
• Forgetting to map persistent storage, causing vault data loss.
• Leaving the admin token and ports exposed, creating security gaps.

Bottom line: Stick to a single, vetted image and follow a step‑by‑step plan.

Step‑by‑Step: Self‑Hosted Bitwarden on Raspberry Pi with Docker

1. Install Docker (if you haven’t already)

curl -sSL https://get.docker.com | sh
sudo usermod -aG docker $USER

Log out and back in so the group change takes effect.

2. Pull and run the Bitwarden‑RS container

docker run -d \
  --name bitwarden \
  -e TZ=Etc/UTC \
  -e ADMIN_TOKEN=supersecureadmintoken \
  -v /home/pi/bitwarden/data:/data \
  -p 80:80 \
  -p 443:443 \
  --restart unless-stopped \
  bitwardenrs/server:latest

Key points

• One‑liner magic – pulls the lightweight Bitwarden‑RS image and starts it instantly.
• Persistent storage – the -v flag ensures your vault survives container restarts.
• Admin token – replace supersecureadmintoken with a strong, unique token and store it safely; it’s the only way to access the admin panel.

3. Access the web UI

Open any browser and go to http://<your-pi-ip>. Log in with the admin token you set, then create your first user account.

Hardening Your Self‑Hosted Vault

Even though Docker isolates the service, additional safeguards are easy:

• Change default ports – run a reverse proxy (Caddy or Nginx) in another container to expose only HTTPS.
• Restrict network exposure – use --publish 127.0.0.1:80:80 if the vault is needed only on your local network.
• Regular updates – the admin panel shows a “Check for updates” button; click it at least once a month.

Automated Nightly Backups

Never lose your passwords again. Add this cron job to zip the data folder and copy it to a USB drive every night:

0 2 * * * tar -czf /mnt/usb/bitwarden-backup-$(date +\%F).tar.gz /home/pi/bitwarden/data

Run crontab -e as the pi user, paste the line, and save. The backup runs at 2 am, creating a timestamped archive you can restore instantly.

Quick Checklist for Beginners

• Install Docker (curl … | sh).
• Add your user to the docker group.
• Execute the one‑liner command above.
• Open the UI, set the admin token, and create a vault.
• Enable the backup cron job.

Follow these five items and you’ll have a secure, self‑hosted Bitwarden Raspberry Pi ready for everyday use.

Wrap‑Up

You don’t need deep sysadmin expertise to protect your credentials. With a single Docker command, a few hardening tweaks, and an automated backup, your Raspberry Pi becomes a reliable password manager. Give it a try, and let us know how it works for you in the comments or by sharing the guide with fellow DIY enthusiasts.