Full Guide to Self-Hosting Password Manager Bitwarden on Raspberry Pi

[@censiCLICK]

Hey guys, just noticed the Docker tag seems to have changed since making the video. Instead of the tag "bitwardenrs/server:raspberry", you now should use "bitwardenrs/server:latest-arm32v6" for Raspberry Pi. I've adjusted the commands in the description accordingly.

[@T3Knical5urg3]

@Sam Hanna Could you maybe elborate on how you fixed this? I am in the same boat.

[@T3Knical5urg3]

@Sam Hanna Just an FYI for others that doing an update/upgrade for the pi will break this. I just tried it and it will update to the latest docker and throw the same error message. Hopefully this is resolved into the future.

[@slinkos]

Now it's changed to vaultwarden/server:latest Vaultwarden is the new project name for bitwardenrs, to avoid confusion with the real bitwarden.

[@MrSouleater5000]

How can I disabled the account login via Email and password?

[@Tymczas]

THX for great content! Have you created promised video on Let's Encrypt on Nextcloud? Can't findit in your YT channel.

[@JimVanderveen]

The short explanation of docker command options was absolutely not a mistake. Well done!

[@augustho6311]

I wonder why many still haven't subbed to this channel. All your vids are very well made, description is very helpful and content is great! I can *feel* how much effort was put in every video. Keep up the great work, respect! 🔥💯

[@stevenjm357]

"Thank you so much, buddy! I came in just to check the basic Raspberry setup and ended up configuring self-hosted Bitwarden. Greetings from Colombia!

[@ichigok2594]

You got a new subscriber. Tried so many do methods and none worked when connecting my mobile to my Bitwarden server which is hosted locally. This worked like charm. One of the best videos about cert. 👍👍

[@steveoste5459]

Dude...This is my first time watching your video and this was a very thorough and detailed walk-through..You totally nailed it. GIving you a sub and watching more stuff

[@andersdorfer]

MY GOD, that AT-AT ripped me out of everything good and bad, love this little quirk, thanks for taking the effort and making something great out of it :3

[@jimtatarakis]

this tutorial is thorough and awesome, thanks for the detailed work.

[@danci947]

This makes me understand how simple the architecture of a password manager is and how any company asking you more than $10/year for a simple password manager is overcharging you.

[@danci947]

@@Bang2Highlights I agree on $10 as cheap for the service they provide. I was against any company that charge customers more than $10 (LastPass) for the same service. Bitwarden offer us a great service for a fair price.

[@DarkFighter84]

A very well made and informative video - however one should remember that due to Raspberry Pi deciding that there is no longer a 'pi' user that you will need to configure some settings via the raspberry pi imager before imaging the OS. Specifically setting a new username and password otherwise should you try to run a headless version of raspbian it won't allow you to log in and you'll have a boot loop.

[@questingbragi8820]

this guide is contectwise and in terms of security on point, very well done!

[@benur9945]

Absolutely amazing! Thank you so much for this detailed instructions. Keep going with those vids.

[@menuchim9740]

Amazing video. Thanks a bunch for creating it. Followed your guide step by step and everything works perfect.

[@MR-tt3eg]

Thank you so much! This video has helped me to finally get vaultwarden up and running

[@Seth_22]

Omg man, thanks you. I've been trying this things for like 2 days

[@optical_ideas]

Nice thanks. As of 2022.01.01 i tested this with opera on windows and the app on ios 14 and ios 15. Works like a charm

[@kearneyIT]

your video is simply awesome. thank you so very much, works like a charm!

[@Zeitgeist2337]

Can I install Bitwarden when I also use Pihole and PiVPN on the same Pi? I have a Pi Gen4 with 2 GB RAM.

[@nate806]

You probably could, but the downside to this would be that if the Pi goes down for any reason you lose 3 services instead of just one.

[@SuskySkate]

have u tried it?

[@Zeitgeist2337]

No, I now use a Mini-PC as a Home-Server instead. I use ESXi for virtualization.

[@SuskySkate]

@@Zeitgeist2337 thank you

[@thebavarian6181]

So good. This is so good. Thank you so much for all the effort.

[@cedricantunes4600]

thank you, i tried doing this with chatgpt and it took me 3 hours to fail. watching your video and struggling in rl (had to run downstairs multiple times because i didnt want to use filezilla.. i have an usb stick after all) i got it to work under my windows pc's opera gx

[@MentalSheep]

Bloody good job! 👍 Great videos!!!

[@tannerbiehn6231]

Would it be possible to make a video specifically on how to backup your vault? Also how exactly would your remove old certificates and place new ones on the raspberry pi? Thank you so much for the video!

[@mafelp8166]

Your have two options for backing up your vault. 1. The first one is, if you go to your vault home page in the browser. Then you click in the top bar on "Tools". Under the export tab you can now export your vault. 2. The second solution is, if you are a server admin, you can back up the whole database (not sure myself, what exactly this backs up, but I think it might be all the users passwords?). This can be achieved by enabling the admin Interface (running the command from the description, you run this one: Stop the container (docker stop bitwarden && docker rm bitwarden) and then run it again docker run -d --name bitwarden --restart unless-stopped -v /bw-data:/data -v /etc/ssl/certs:/ssl -e ROCKET_TLS='{certs="/ssl/bitwarden.crt",key="/ssl/bitwarden.key"}' -p 8080:80 -e ADMIN_TOKEN=SUPERSECUREADMINTOKEN bitwardenrs/server:latest-arm32v6 Be sure to replace SUPERSECUREADMINTOKEN with an actual admin token. For your second question: You just repeat all the steps that were used to create the certificates in the video and restart your docker container. This replaces the old certificates with the new ones.

[@MartinSchlobach]

Awesome Video and wonderful explained! Looking forward to see more Videos!

[@davidward1729]

Very helpful for a newbie like me! Thx

[@mikk0706]

Good tutorial. I had problems with instaling docker and bitworden so I used some other guy's tutorial b begining and ut https part was very helpfull

[@shaunnichols4664]

Very nice. Since this vid was made Bitwarden split the RS version in this vid to vaultwarden, and there is a new client (at least for firefox) that won't connect to this version. Upgrading was fairly straight forward if you know a little docker.

[@youngblood4826]

Danke für das hilfreiche Tutorial!

[@basim313]

Great Video... I'm completely new to the docker & Pi world. So including every piece of information was really helpful... My question is, can I install this on top of vmware virtual machine in my organization? also, when bitwarden releases an update, how can I update it? my question might be silly, but as I said, i'm new to docker world

[@conor_schall]

Very well made and informative video! I’ve been on the fence about purchasing a raspberry pi and this tutorial finally convinced me. Just one question, is the raspberry pi 3B+ powerful enough to host Bitwarden along with other software such as pi hole or do you have to purchase separate devices in order to do that? Thanks!

[@wchorski]

absolutely. I could run a low traffic website, bitwarden, pi hole, and a samba share all at the same time. Now the frequency of how much you use each app could vary so you'll never really know until you got everything running and peek at that htop

[@wayne6220]

Excellent video, thank you.

[@censiCLICK]

Thank you very much!

[@milo1269]

This was very helpful, thank you very much

[@leuuon]

Thanks. Subscribed

[@AdrianKubasa]

Thanks for the video. After a test of 10min the deleted ma LastPass account with I was using for 12 years!

[@GermanTimecrafter]

i genuinely love you.

[@thomasoderso6930]

klappt super, danke dir =)

[@Gery-zg7ky]

super video, thanks dude

[@roobyx]

Shouldnt the OS be the "Lite" (headless) version? If its going to be used as a server only? Also I the WiFi config link seems to be missing.

[@Vito_0912]

Can I see my Passwords, when I am not in my local network. So are they saved locally on the device?

[@anarchoN3rd]

I know this is a 5 month old comment, but if you're still wondering... Yes you can see them, but no they are not on the device. You would simply be hosting the server that the passwords are stored on which can be accessed through all of the same means that are available when Bitwarden hosts them for you.

[@Vito_0912]

@@anarchoN3rd Thank u

[@samurai2150]

Hey thanks for the amazing tutorial! I followed every step but for some reason when I connect to the server it gives an error "Unable to connect". I did everything in sequence and even when I try to re-enter the launch code for Bitwarden server it says that it's already running with the certificate. When could possibly be wrong? Please help!

[@mikee.]

Instead of using filezilla you could also use scp in the command line :)

[@thezebiano]

Amazing video.

[@Bang2Highlights]

Worked brilliantly, except it didn't show how to allow access to the admin page so you can disable new user creation and other things like that. Brilliant guide!

[@timothypattison1806]

At 2:08 you mentioned checking the description for how to enable SSH with wi-fi but I was unable to find this in the description. Do you have a link for setting this up? Thanks!

[@tcbobb1613]

This is a super dumb question. Can you access your Bitwarden password Manager when your self hosted server is off? I plan on hosting it on my computer but what to access my Password to go when my computer is turned off.

[@censiCLICK]

Yes, you can use your vault, it just won't sync until it's connected again.

[@tcbobb1613]

@@censiCLICK Thanks!

[@KennyKung]

Thanks for the instruction, it is very good for me, I just want to know where to backup the Bitwarden data file in Pi?

[@censiCLICK]

I'm not completely sure I understand: If you want to know where the Bitwarden data is stored, it should be the "/bw-data" directory on the Pi. If you just want to backup your passwords, simply use the Bitwarden browser extension or the desktop app to export your vault to an unencrypted text file.

[@ommeking]

informative. I was looking to secure my passwords on bitwarden and now im even more confused haha

[@marsman.]

Will it be a problem if I disconnect the pi and later due to dynamic IP, the ip address of the pi changes? Because we named while making the certificated, with the ip address of the pi?

[@andreasrottenanger6355]

Hi did the installation the same way as you - all is working on desktop PC (connection over chrome also) but can't connect at android app (tested older version and latest version) where can i get help?

[@SelectTacoS]

Will this work outside your home network?

[@censiCLICK]

It COULD if you set up port forwarding in your router. But I intentionally didn't do that since running a public web server is always a security risk to some degree. If syncing only when at home is not enough, I would recommend connecting to your home network using a personal VPN. Some routers even have that feature built in.

[@JM-gr1ys]

Not sure if this helped, but the docker run command in the description is missing a '/' after /data and /ssl. Adding them back into seemed to fix some issues I was having: docker run -d --name bitwarden --restart unless-stopped -v /bw-data:/data/ -v /etc/ssl/certs:/ssl/ -e ROCKET_TLS='{certs="/ssl/bitwarden.crt",key="/ssl/bitwarden.key"}' -p 8080:80 bitwardenrs/server:raspberry

[@nate8824]

Thank you so much!

[@halbgefressen9768]

Great video! I just got one problem: Signing in with the Android app doesn't work, it throws an IO error with some SSL stuff. Every other client works fine, even the mobile browser extension.

[@csbluechip]

A FANTASTIC video - Thank You ...I am wondering if you should `chown root:root /etc/ssl/certs/bitwarden.*` ...although, in fairness, if you can sudo as user:pi, I guess the additional security is little more than "good practice" :/

[@user-df8cc1ec5e]

3:15 - You selected 1.2.13-2, but wouldn't the latest version be 1.3.7-1 that's 6 lines underneath your selection?

[@KalpaPrabashwera]

Hi Nice Video one little issue how to configure SMTP for the invites and such

[@brandon_bakkers]

Also is there a video for updating the Bitwarden Manager on the raspberry pi?

[@heliodoro58]

THANKS for this great video. Please could you do one for Nextcloud ? Thanks

[@Guilherme-xy9sw]

With this method, I can access the bitward outside my home network, for explain with my mobile data?

[@ROOTDNB]

How can I edit environment variables? Or better question, where can I find global.override.env file for the bitwarden? This is unclear to me. I'd like to set up a SMTP server and allow 2FA, but can't do without changing configuration global.override.env... Thanks

[@thorntontarr2894]

This question is totally basic: How do I get around the issue that the IP address used is never static as it is "leased" from my ISP. Perhaps your IP local is static but not the what I see from outside my router. If I am already behind in solving this program, please refer me to a link which "addresses" this IP address issue. Vielen Dank.

[@paly7504]

im getting failed to fetch on chrome extension, also i cant login using :8080 from any device. any idea? Thanks in advance

[@TechnoLifts]

Can you also make a video about how to update the docker container bitwarden to the latest version? :)

[@saifurrahman2698]

great video

[@goranjosic]

Im using KeePass with local database storage and ftp sync between desktop and android - and that is working great for me over 8 years - but this bitwarden setup seems interesting because of possibility to access bitwarden server from outside with port forwarding. I'm not sure how safe would that be?!

[@ZattyBoi]

at the test, it was opening bitwarden vault, but at the end, doing all the security etc and installing the cert in my opera, it just says that this site didn't send any data Yeah, i turned off bitwarden, then ran it without certification and it seems to show the login page again, but running it with the certifications doesn't do anything just site can't be reached

[@deViant14]

Hmm...that's cool but I don't know the returns vs. using the standard server with Duo 2FA

[@brobi]

do i get it right, that the ca-certificates on the devices will last 10 years (3650 days) and i have to repeat that step only every ten years (put it on every device manually), BUT i will have to create new bitwarden-certificates on the pi every year?

[@bigchew3149]

Cool video.. I run/host/manage 2 Dual Xeon servers at home for me and a fuw frinds & i would love to know how to set up bitwarden on Unraid &Do i need to buy/rent a domain to do this or what ? I would also love to see some one do a PXE boot from start to finish..

[@Cobal]

You don't need a domain for this because bitwarden syncs the passwords every time you are in your network. But if you want to connect from outside your server, you can do this with an openvpn container.

[@Redneckrampage]

Is it safe to use bitwarden since it's not coming from Bitwarden?

[@angrynerd2103]

I mean generally since you are the one hosting it it should be fine.

[@Dayfire010]

I continue to get the following error with my cert when I import it and try to go the website "Unable to communicate securely with peer: requested domain name does not match the server’s certificate. " What did I miss for it not to match? I am using the IP as the FQDN when it asked me both times.

[@tontonpascal1988]

Hi. Edit : fixed it with "docker rm bitwarden" at first Every thing fine until I finally try to start BitWarden Server (8:47 command in description) I got this message : "docker: Error response from daemon: Conflict. The container name "/bitwarden" is already in use by container "6f074590abde9ed6369cf4def10d082c9c2a0c1c456ffb806e1d71ffd3f9f63c". You have to remove (or rename) that container to be able to reuse that name." How do I do that ? I'm complitly new to Docker.

[@debarkamondal6406]

i added the custom url to the chrome extension but if I try to log in it shows that the username and password is invalid

[@aimpizza6823]

8:47 when running it, my browser says ERR_EMPTY_RESPONSE pls help

[@onkelwernerswerkstatt]

thx for that nice how to! it works great but i ran into a problem using the windows app... i recive an error filed to fetch. do anyone know how to fix that?

[@grzenio_l]

Hello. I had the same problem. Solution is described in this page: bitwarden.com/help/article/certificates/ "Windows To trust a self-signed certificate on Windows, run certmgr.msc and import your certificate into the Trusted Root Certification Authorities." If certificate is in a category other than "Trusted Root Certification Authorities" it will not work. It worked for me, I hope it will help you too :)

[@nordle4208]

@3:05 need to install curl to rpi first to make this work

[@madswilliam4888]

Hi CensiCLICK, I got this up and running a little year ago, and its been running smooth until now, I need to keep Bitwarden updated, but how do I do that? /updateself command is not working.

[@boodi1170]

Im getting an error on the last bit of running the certificate im running on x86 running ubuntu and not sure how to get around it

[@HAHArceus]

Great video! I just can't seem to get my certificate to work. Firefox claims the domain names dont match and lists two identical IPs with the error SSL_ERROR_BAD_CERT_DOMAIN. Anyone know how I can fix this?

[@MrRomeoforLife]

hallo, also bei chrome funktioniert das mit dem zertifikat nicht er sagt trotzdem unsicher...!?

[@Emwaris]

THANKS ! HOLYYYY

[@ConcernedWolf]

After installing the certificate I can no longer access the page, I get a connection refused, can I get help?

[@O0011]

you are awesome

[@timothykittle3165]

will this work out of network because using a local ip?

[@cosmos2k4]

i can only loggin on firefox. the extension, android app, windows app, allways says wrong user or password. double checked and they are correct. can anyone help?

[@Multiniggo]

WARNING: The requested image's platform (linux/arm/v6) does not match the detected host platform (linux/arm64/v8) and no specific platform was requested 4319470c79b7a755d17480254eac4bde1136ae0a5009d12d43da42c8de33fd52 @last step.... :(

[@_capr_545]

I can't get HTTPS to work for my server. What did I do wrong?

[@martin6901]

Wouldn't you be better off using Elliptic Curve for your keys? Should be faster especially on a Pi.

[@martin6901]

@thefallenshadow pretty sure the option is between RSA and ECC.

[@martin6901]

@thefallenshadow that is the wrong choice, not because RSA 4096 is broken but because RSA is old and slow. ECC is always preferred as a modern cryptographic solution.

[@martin6901]

@thefallenshadow I can only suggest you do some more research.

[@martin6901]

@thefallenshadow I'm not interested in insulting nor measuring qualifications with you, but a smaller EC key is superior both in speed and bit vs bit security to RSA. RSA is unfortunately resorting to larger and larger keys to remain secure, and while there is currently nothing horribly wrong with a large RSA key, from a security perspective, it is slower and inelegant.

[@spudhead169]

Out of date, it's now called Vaultwarden. This video needs to be dleted and a new one uploaded to prevent confusion.

[@ParthParikh23]

does this work outside the network?

[@madswilliam4888]

Hi @censiCLICK - this guide is great, but I keep getting error when I try to pull bitwardenrs/server:raspberry pi@raspberrypi:~ $ docker pull bitwardenrs/server:raspberry Error response from daemon: manifest for bitwardenrs/server:raspberry not found: manifest unknown: manifest unknown Anyone know a fix to this?

[@DanielAlexandrescu]

I have the same problem, also reported few days back by other users (@Tom Maxwell) . It seems that particular image has been deleted....

[@madswilliam4888]

@@DanielAlexandrescu I found out that you can run Bitwardenrs/server:latest instead, but dont know the diffrent from rapsberry

[@DanielAlexandrescu]

@@madswilliam4888 Already tried with latest, the install in getting stuck. After a while the app URL is up and running, but cannot create a user using the interface for some reason (I assume the problem is that the install gets stuck).

[@timothyrobertson4451]

use this command instead: docker pull bitwardenrs/server:latest-arm32v6

[@csbluechip]

Be warned. When self-hosted, Bitwarden's data directory stores a PLAINTEXT list of what sites you visit (as well as your email address, and your recovery question)

[@mllrrd]

Where?

[@csbluechip]

@@Bang2Highlights I spoke to bitwarden but they were not concerned

[@nobytes2]

​@@csbluechipbitwarden-rs isn't a product by the company bitwarden so why should they be concerned lol? bitwarden-rs is an open source project.

[@jaisemroy8934]

Bro is there anyway to make the server accessible over the internet

[@picklypt]

You would have to port forward the port that the service uses to the Pi's IP in your routers settings

[@jaisemroy8934]

@@picklypt bro I tried using duckdns and nginx proxy manager but it is not accessible over the internet. Tried opening the ports 80 and 443 on the router but still no luck.

[@stevenschulze3758]

@censiCLICK Hey, yes the guide was very helpful, but I have a bug on version 2.15.1 (raspberry). I register with my E-Mail and password and sign in normally, if I locked the safe I can't log in again with my Master Password on browser extensions for Firefox and the same bug is on my Android device. I always have to full log out on the extension and the App to access new to the Bitwarden. First, I think it is my Port mapping to the Docker Container “Bitwarden” but the bug is also on port mapping 80:80. 😯 At the end I have sleep a night to fix the problem. 🤔 On a next day, I have to save the progress on my PC in an image and I have a new clean installation on my Raspberry 4 with a few or one differences, I don't think so. I don't have to pull the bitwarden:raspberry Version on my Raspberry. I have pull and install the bitwardenrs/server:latest that is a newer Version of Bitwarden Docker (before: 2.15.1 (raspberry) || after: 2.16.1 (latest). At the end of my installation I check whether the bug persists, but it works fine. 😁👍 The bug is on the version 2.16.1 fixed. 👍 I do not know exactly what the cause on version 2.15.1 (raspberry) is! hope my English isn't too bad. Languages were never my strength.😊 regards from Germany and Stay healthy

[@flawlesscode6471]

censiClick is german as far as i know

[@RobertLugg]

Follow on topics that would help me: is there a way to automate deployment like by using Ancible? What if I don’t want a self signed cert? Can you buy them? Also what IP address do you use? I thought it would have to be a public static one.

[@tech3425]

Using a public file drop app to share our certificate seems like a weak link

[@updatedotexe]

Not enough explanation of what is actually being done...

[@hannohoffman8564]

ty

[@Redneckrampage]

How safe is this?

[@Gery-zg7ky]

bitwarden is a great idea in itself, but i think it's not as safe as keepass. For the simple reason that Bitwarden can be called up via a browser and if someone gets the login data (browser data is often read when phishing), he has everything. Keepass, on the other hand, is a file that is encrypted on the pc or cloud, where it is more difficult to phish the login password.

[@yeezet4592]

Not connecting in android

[@Vito_0912]

How do I update?