Vaultwarden on Edge, Bitwarden you control

Deploy

A team vault in five steps

Docker Compose, a hashed admin token, a CDN domain with cache bypass rules, and a nightly backup.

~/vault — zsh

$ edge compute create --name vault \

--size s-2vcpu-4gb --image ubuntu-24 \

--region london --script docker

✓ vm-c47d08 running · 64.34.86.19

$ docker compose up -d

✓ vaultwarden started · SQLite at /data

$ edge cdn domains add cdn-a1b2c3 \

--domain vault.acme.com \

--origin https://64.34.86.19

✓ SSL issued · /api and /identity uncached

Vault encryptionE2E

vault.acme.comHealthy

Servervaultwarden · Rust

DatabaseSQLite · 14 MB

1. 01

   Create the VM and a private bucket

   Generate the admin token hash once on the VM with: docker run --rm -it vaultwarden/server /vaultwarden hash. Store it in .env as ADMIN_TOKEN, in single quotes.

   shellCopy

   $ edge compute create --name vault --size s-2vcpu-4gb \
       --image ubuntu-24 --region london --script docker
   $ edge storage create vault-backups

2. 02

   Write the compose file

   Sign-ups are off; invite people from the admin page. Add SMTP_* settings so invitation emails can be sent.

   docker-compose.ymlCopy

   services:
     vaultwarden:
       image: vaultwarden/server:latest
       env_file: .env   # ADMIN_TOKEN='$argon2id$...' and SMTP_*
       environment:
         DOMAIN: https://vault.acme.com
         SIGNUPS_ALLOWED: "false"
         INVITATIONS_ALLOWED: "true"
       ports: ["127.0.0.1:8080:80"]
       volumes: ["./vw-data:/data"]
       restart: always

3. 03

   Start it and put the CDN in front

   Proxy :443 on the VM to port 8080. The Bitwarden apps need the HTTPS certificate the CDN issues.

   shellCopy

   $ docker compose up -d
   $ edge cdn create --name vault
   $ edge cdn domains add cdn-a1b2c3 \
       --domain vault.acme.com \
       --origin https://<vm-ip>

4. 04

   Make sure vault traffic is never cached

   Most vault calls are POSTs or authenticated, which the CDN won't cache anyway. These rules make it explicit.

   CDN configuration (JSON)Copy

   {
     "caching": {
       "respectOriginHeaders": true,
       "rules": [
         { "path": "/api/**", "bypassCache": true },
         { "path": "/identity/**", "bypassCache": true },
         { "path": "/notifications/**", "bypassCache": true },
         { "path": "/admin/**", "bypassCache": true }
       ]
     }
   }

5. 05

   Back up every night

   SQLite's .backup command takes a consistent copy while the server runs. The bucket stays private.

   /etc/cron.daily/vault-backupCopy

   #!/bin/sh
   set -e
   . /etc/edge.env   # exports EDGE_API_KEY for the Edge CLI
   cd /srv/vault
   sqlite3 vw-data/db.sqlite3 ".backup '/tmp/db.sqlite3'"
   tar czf /tmp/vw.tgz --exclude='db.sqlite3*' vw-data -C /tmp db.sqlite3
   edge storage cp /tmp/vw.tgz "vault-backups/$(date +%F).tgz"

Prefer to hand it off? Give the job to your AI agent or have our engineers do it.