Skip to main content
Vaultwarden is a lightweight, self-hosted password manager that speaks the Bitwarden protocol — and is intended for use with Bitwarden clients. Compatibility depends on the server and client versions; check Vaultwarden’s documentation and release notes before upgrading either. It’s a single container with a small SQLite database, so it’s one of the lightest apps in the catalog. This guide covers configuring Vaultwarden on Suji. Check the version and release notes shown in the marketplace before installing or upgrading. Vaultwarden is maintained upstream; Suji provides the marketplace packaging.
The first person to open the URL can create an account. Register yours immediately after install, then close sign-ups (see Lock it down).

​
Install

Dashboard → Apps → Vaultwarden → Install: You don’t enter a URL — Suji wires the public https://<subdomain>.suji.fr into Vaultwarden’s DOMAIN automatically, which URL-dependent features such as WebAuthn and attachments use. Click Deploy. When the install is running, it’s live at https://vault-<random>.suji.fr over HTTPS through the tunnel.

​
First connection — create your account

  1. Open the install URL (https://vault-<random>.suji.fr).
  2. Click Create account and register (email + master password).
  3. Install a Bitwarden client (browser extension, desktop, or mobile).
  4. In the client, before logging in, open settings and set the Server URL (self-hosted) to your https://vault-<random>.suji.fr address.
  5. Log in with the account you just created. Your vault syncs.
Suji cannot reset your master password to decrypt your vault. Keep it safe and prepare an encrypted export or any recovery option supported by your configuration before you need it. Do not assume an ordinary account-password reset can recover encrypted vault data.

​
Lock it down

Vaultwarden ships with sign-ups open so you can create your first account. As soon as you (and anyone you intend to invite) have registered:
  1. Open the install’s Variables tab.
  2. Set SIGNUPS_ALLOWED to false.
  3. Click Apply changes and verify that public registration is closed.
This closes open registration. Explicit invitations and any signup-domain overrides are separate settings; review those too. Existing accounts remain. To invite users after closing sign-ups, enable the admin panel: set a strong ADMIN_TOKEN in Variables and click Apply changes, then open https://vault-<random>.suji.fr/admin, log in with that token, and send invites from there.

​
Two-step login (2FA)

Configure the two-step login methods offered by your installed Vaultwarden version under Settings → Security → Two-step login. The template supplies the public DOMAIN, which is needed for URL-dependent features such as WebAuthn. Test sign-in and save recovery codes before relying on a method; support also depends on your browser and client.
Email-based 2FA and password-hint / invite emails need an SMTP server, which isn’t configured by default — see Email.

​
Email

Vaultwarden sends email for invites, password hints, and email-based 2FA — but no mail provider is configured by default, so those won’t send until you add SMTP. Use your mail provider’s documented SMTP settings and test delivery; port 587 with STARTTLS is a common option. Add the SMTP_* env vars yourself in the install’s Variables tab, then click Apply changes to redeploy.

​
Day-to-day management

​
Troubleshooting

Set the Server URL in the client to your full https://vault-<random>.suji.fr address before logging in — not the default Bitwarden cloud server.
WebAuthn needs the public DOMAIN, which Suji sets only when the install is exposed. Make sure exposure is on (it is by default) and you’re reaching the vault over its https://…suji.fr URL, not an internal address.
The admin panel is disabled unless an Admin panel token is set. Set ADMIN_TOKEN in Variables and apply the change, then log in at /admin with that exact value.
Expected until you configure SMTP — see Email above (check credentials, TLS settings and outbound connectivity).

​
Where things live

Uninstalling deletes the volume by default — that’s every vault. Choose keep data during uninstall to preserve it, and keep your own export as a backup.
  • The template limits the single container to 512 MiB and recommends 1 GiB of available memory. Small is a starting point with spare capacity; monitor actual memory and attachment storage.
  • Storage grows mainly with file attachments; the password data itself is tiny.

​
Reporting issues