Start by updating your system and installing base dependencies.

# Update the system
sudo apt update && sudo apt upgrade -y

# Install dependencies
sudo apt install -y curl wget gnupg lsb-release ca-certificates apt-transport-https software-properties-common

Configure the Firewall (UFW)

If you're using UFW, configure the necessary rules:

# Allow SSH (if not already done)
sudo ufw allow ssh

# Allow HTTP and HTTPS
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

# Enable the firewall
sudo ufw enable

# Check status
sudo ufw status

Docker is essential for running Bitwarden. Here's how to install it properly on Ubuntu/Debian.

Add the Official Docker Repository

# Add Docker's GPG key
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg

# Add the Docker repository (for Ubuntu)
echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

# For Debian, replace "ubuntu" with "debian" in the command above

Install Docker Engine

# Update packages
sudo apt update

# Install Docker
sudo apt install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

# Verify installation
docker --version
docker compose version

Enable Docker on Boot

sudo systemctl enable docker
sudo systemctl start docker

For security reasons, never install Bitwarden as root. Create a dedicated user:

# Create the bitwarden user
sudo adduser bitwarden

# Set a strong password
sudo passwd bitwarden

# Create the docker group (if it doesn't exist)
sudo groupadd docker

# Add the user to the docker group
sudo usermod -aG docker bitwarden

# Create the installation directory
sudo mkdir -p /opt/bitwarden

# Set permissions
sudo chmod -R 700 /opt/bitwarden

# Assign ownership to the bitwarden user
sudo chown -R bitwarden:bitwarden /opt/bitwarden

Bitwarden requires an installation ID and key to operate. These credentials are free and allow Bitwarden to verify self-hosted installations.

1. Go to https://bitwarden.com/host/
2. Enter your email address
3. Note the Installation ID and Installation Key provided

Important: Keep this information safe, you'll need it during installation.

Now switch to the bitwarden user to perform the installation:

# Log in as bitwarden
su - bitwarden

# Navigate to the installation directory
cd /opt/bitwarden

Download the Installation Script

# Download the official script
curl -Lso bitwarden.sh "https://func.bitwarden.com/api/dl/?app=self-host&platform=linux" && chmod 700 bitwarden.sh

Run the Installation

./bitwarden.sh install

The script will ask several questions. Here's how to answer them:

1. Enter the domain name for your Bitwarden instance:

   • Enter your domain name, e.g., vault.mydomain.com

2. Do you want to use Let's Encrypt to generate a free SSL certificate? (y/n):

   • Answer y to automatically generate a free SSL certificate via Let's Encrypt
   • If you answer n, you'll need to provide your own certificate

3. Enter your email address (Let's Encrypt):

   • Enter a valid email address for certificate expiration notifications

4. Enter your installation id:

   • Paste the Installation ID obtained in Step 4

5. Enter your installation key:

   • Paste the Installation Key obtained in Step 4

6. Enter your region (US/EU):

   • Choose US or EU based on your location (for paid licenses)

The installation downloads all necessary Docker containers. This may take several minutes depending on your connection.

After installation, configure essential settings, especially the SMTP server for sending emails.

Edit the Configuration File

nano ./bwdata/env/global.override.env

SMTP Configuration (Required)

Find and modify the following lines with your SMTP settings:

globalSettings__mail__replyToEmail=no-reply@mydomain.com
globalSettings__mail__smtp__host=smtp.mydomain.com
globalSettings__mail__smtp__port=587
globalSettings__mail__smtp__ssl=false
globalSettings__mail__smtp__username=user@mydomain.com
globalSettings__mail__smtp__password=your_smtp_password
globalSettings__mail__smtp__startTls=true

Configuration examples for different providers:

For Gmail:

globalSettings__mail__smtp__host=smtp.gmail.com
globalSettings__mail__smtp__port=587
globalSettings__mail__smtp__ssl=false
globalSettings__mail__smtp__startTls=true

For Office 365:

globalSettings__mail__smtp__host=smtp.office365.com
globalSettings__mail__smtp__port=587
globalSettings__mail__smtp__ssl=false
globalSettings__mail__smtp__startTls=true

For Amazon SES:

globalSettings__mail__smtp__host=email-smtp.us-east-1.amazonaws.com
globalSettings__mail__smtp__port=587
globalSettings__mail__smtp__ssl=false
globalSettings__mail__smtp__startTls=true

Admin Portal Configuration (Optional)

To access the system administration portal, add your email:

adminSettings__admins=admin@mydomain.com

The portal will be accessible at: https://vault.mydomain.com/admin

Apply Changes

./bitwarden.sh restart

Now launch your Bitwarden instance:

./bitwarden.sh start

The first startup may take a few minutes as Docker downloads images from GitHub Container Registry.

Verify Everything is Working

# List running containers
docker ps

You should see several Bitwarden containers with "Up" and "healthy" status:

• bitwarden-mssql
• bitwarden-web
• bitwarden-attachments
• bitwarden-api
• bitwarden-identity
• bitwarden-sso
• bitwarden-admin
• bitwarden-icons
• bitwarden-notifications
• bitwarden-events
• bitwarden-nginx

1. Open your browser and navigate to https://vault.mydomain.com
2. You should see the Bitwarden login page
3. Click Create Account to create your first user
4. Check your email to verify the account

Tip: If the verification email doesn't arrive, check your SMTP configuration and logs with docker logs bitwarden-api.

Useful Commands

Here are the main bitwarden.sh script commands: