Skip to main content
Bitwarden · Vaultwarden · Docker · Cloudflare Tunnel · Self-Hosted · Security

​
Overview

A self-hosted Bitwarden password manager server deployed through Docker Compose and Cloudflare Tunnel. The host opens no inbound ports and the host IP is not exposed. All encryption and decryption happens on the client side; the server stores only ciphertext (zero-knowledge architecture), so the vault security is identical across all three deployment options. Vaultwarden (community edition) is the default recommendation: it is compatible with all official Bitwarden clients, has the lowest resource footprint, and all features are free. The official Lite and Standard editions are available for situations that require official vendor support or organizational compliance guarantees.

​
Core features

  • Cloudflare Tunnel reverse tunnel: no inbound ports, host IP not exposed
  • Cloudflare Edge handles TLS termination, WAF, and DDoS protection; no self-managed certificates needed
  • Three configurations covering personal, small-team, and organizational needs, each with a separate Docker Compose file and environment variable template
  • Compatible with all official Bitwarden clients (desktop, browser extension, mobile)
  • Vaultwarden Admin Panel included, with optional Cloudflare Access restriction
  • Client-side encryption: zero-knowledge architecture, the server never sees plaintext passwords

​
Architecture

bitwarden-server
docker-compose.yml · Vaultwarden (default) + Cloudflared
.env.template · environment variable template
lite · official Lite edition
docker-compose.yml
.env.template
standard · official Standard edition (microservices, 10 containers)
docker-compose.yml
.env.template

​
Configuration options

​
Quick start

1

Configure the Cloudflare Tunnel

Create a tunnel in the Zero Trust dashboard and copy the Tunnel Token. Set the Public Hostname service URL to the container name (e.g. http://bitwarden:80), not localhost.
2

Set environment variables

Fill in the Cloudflare Tunnel Token, the optional Vaultwarden Admin Token, and any other required values.
3

Start the service

For Lite or Standard, cd into the lite/ or standard/ directory first, then run the same command.
4

Configure the client

Open an official Bitwarden client, enter your self-hosted server’s Cloudflare URL in the server settings, then create an account and sign in.

​
Notes

The Admin Panel (/admin) should be restricted with a Cloudflare Access Policy or disabled in production if not needed. .env contains database passwords and the Admin Token; never commit it to version control. The official Standard edition requires a Bitwarden Installation ID obtained from bitwarden.com/host before deployment.

​
In practice

Suited for individuals or small teams who want full control over their vault data without relying on a third-party cloud service. The Cloudflare Tunnel makes an instance running on a NAS or home server securely reachable from anywhere, without firewall rules or a static IP.