Your own password manager at home, with HTTPS and no open ports (Vaultwarden + Tailscale)

I’d wanted to stop relying on someone else’s cloud password manager for a while. Vaultwarden is a lightweight, open-source take on the Bitwarden server: it works with the official Bitwarden apps (mobile, browser, desktop) and easily fits on a Raspberry Pi.

The challenge isn’t installing it, that’s five lines. The challenge is making it secure: your passwords can’t be exposed to the Internet, and yet you need to use them on your phone away from home.

The HTTPS problem

Vaultwarden needs HTTPS. It’s not a whim: your passwords are encrypted and decrypted on your device, and browsers only allow those crypto functions on secure pages. Over plain HTTP, the web vault simply doesn’t work.

The usual options for HTTPS at home are:

• Buy a domain, open port 443 and set up a reverse proxy with Let’s Encrypt. It works, but you’re exposing your password manager to the Internet.
• A self-signed certificate. The apps complain and it’s a hassle.
• Tailscale Serve. That’s what I chose.

What Tailscale is and why it fits

Tailscale creates a private network between your devices (phone, PC, Pi) using WireGuard underneath. Each machine gets a name inside your private network, like my-pi.your-net.ts.net.

And the important bit: with Tailscale Serve, Tailscale gets that name a real HTTPS certificate (from Let’s Encrypt) and renews it automatically. The service is only reachable from your devices connected to Tailscale. From the Internet, it doesn’t exist.

Step 1: Vaultwarden in Docker, listening locally only

In my docker-compose.yml:

services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: unless-stopped
    environment:
      DOMAIN: "https://my-pi.your-net.ts.net:8443"
      SIGNUPS_ALLOWED: "true"      # only while you create your account
      SHOW_PASSWORD_HINT: "false"
      TZ: Europe/Madrid
    ports: ["127.0.0.1:8222:80"]
    volumes: [./vaultwarden:/data]

The key is 127.0.0.1:8222:80. The container is only reachable from the Pi itself, not even from the rest of the home network. The only way in will be Tailscale.

docker compose up -d vaultwarden

Step 2: publish it with Tailscale Serve

With Tailscale already installed on the Pi and HTTPS enabled in the Tailscale admin console (under DNS):

sudo tailscale serve --bg --https=8443 http://127.0.0.1:8222

This says: “on port 8443, over HTTPS, forward to Vaultwarden”. Check it with:

tailscale serve status

I use 8443 because 443 is already taken by another app. If yours is free, you can use the standard one.

Step 3: create your account and close the door

From a device with Tailscale, open https://my-pi.your-net.ts.net:8443, create your account with a long master password and write it down on paper somewhere safe. If you lose it, nobody can recover your passwords, not even you.

Then disable sign-ups:

      SIGNUPS_ALLOWED: "false"

docker compose up -d vaultwarden

Now nobody else can create an account on your server.

Step 4: connect the Bitwarden apps

In the Bitwarden mobile app or browser extension, before logging in choose self-hosted server and enter https://my-pi.your-net.ts.net:8443. The device needs Tailscale switched on.

A practical note: the apps keep an encrypted copy of your vault. If you’re ever without Tailscale, you can still read your passwords; changes just won’t sync until you reconnect.

Step 5: backups (don’t skip this)

A password manager without backups is a ticking time bomb. Vaultwarden has a command to make a consistent copy of its database:

docker exec vaultwarden /vaultwarden backup

It leaves a db_DATE.sqlite3 file in its data folder. I run it every night before my NAS backup, and delete ones older than 7 days. I also export the encrypted vault from the web now and then.

Summary

• Vaultwarden only listens on 127.0.0.1.
• Tailscale Serve gives it real HTTPS and makes it reachable only from my devices.
• Sign-ups closed after creating the account.
• Database copy every night.

Zero ports open on the router. That’s the setup I sleep well with.