{"id":405,"date":"2026-09-05T21:23:09","date_gmt":"2026-09-06T00:23:09","guid":{"rendered":"https:\/\/www.linuxpro.com.br\/2026\/09\/vaultwarden-bitwarden-self-hosted\/"},"modified":"2026-09-08T04:11:07","modified_gmt":"2026-09-08T07:11:07","slug":"vaultwarden-bitwarden-self-hosted","status":"publish","type":"post","link":"https:\/\/www.linuxpro.com.br\/es\/2026\/09\/vaultwarden-bitwarden-self-hosted\/","title":{"rendered":"Vaultwarden: Bitwarden self-hosted no Linux"},"content":{"rendered":"<p><img loading=\"lazy\" decoding=\"async\" alt=\"Mascote do LinuxPro abrindo o cofre do Vaultwarden\" src=\"\/wp-content\/uploads\/2026\/09\/vaultwarden-v4.webp\" width=\"1052\" height=\"652\" \/><\/p>\n<p class=\"translation-block\">O <a href=\"https:\/\/github.com\/dani-garcia\/vaultwarden\">Vaultwarden<\/a> \u00e9 um servidor <strong>compat\u00edvel com os clientes oficiais do Bitwarden<\/strong>, escrito em Rust. Cabe num Raspberry Pi, gasta dezenas de MB de RAM e libera no self-host o que o Bitwarden oficial cobra: TOTP, Send, organiza\u00e7\u00f5es, emergency access. N\u00e3o \u00e9 o Bitwarden Inc. \u2014 \u00e9 o projeto da comunidade (ex-<em>bitwarden_rs<\/em>), AGPL-3.0, hoje na <strong>1.37.2<\/strong>.<\/p>\n<p><!-- more --><\/p>\n<p>Se voc\u00ea j\u00e1 tem um Linux na internet e n\u00e3o quer mandar o cofre para a nuvem de ningu\u00e9m, este \u00e9 o caminho curto: um container, HTTPS na frente, apps oficiais apontando para o seu dom\u00ednio.<\/p>\n<h2>O que \u00e9 (e o que n\u00e3o \u00e9)<\/h2>\n<p>Os apps (Android, iOS, desktop, extens\u00e3o, CLI) falam a API do Bitwarden. O Vaultwarden implementa essa API. O cofre continua <strong>criptografado no cliente<\/strong> (zero-knowledge): o servidor guarda blobs que ele n\u00e3o consegue ler.<\/p>\n<ul>\n<li><strong>Serve para<\/strong> voc\u00ea, a fam\u00edlia, o homelab, um time pequeno. Roda em SQLite (padr\u00e3o), MySQL ou PostgreSQL. ~50 MB de RAM em idle.<\/li>\n<li><strong>N\u00e3o serve para<\/strong> empresa que precisa de SOC 2, SLA e suporte da Bitwarden Inc. O projeto <em>n\u00e3o tem auditoria formal equivalente<\/em>. Voc\u00ea \u00e9 o backup, o patch e o firewall.<\/li>\n<\/ul>\n<p>A 1.37.2 (agosto de 2026) \u00e9 obrigat\u00f3ria para clientes Bitwarden 2026.8.0+. SSO via OpenID Connect existe (wiki); SCIM\/Secrets Manager oficiais, n\u00e3o.<\/p>\n<h2>Subir com Docker e Caddy<\/h2>\n<p>A via recomendada pelo projeto \u00e9 o container. HTTPS \u00e9 obrigat\u00f3rio: o web vault usa Web Crypto, que o browser s\u00f3 libera em contexto seguro. Caddy pede o certificado sozinho. (Se Docker ainda \u00e9 novidade, tem o <a href=\"\/es\/2017\/08\/curso-de-docker-gratis\/\">curso de Docker<\/a>.)<\/p>\n<p>Gere o token do painel admin (Argon2) <em>antes<\/em> do compose:<\/p>\n<pre data-no-translation=\"\"><code class=\"language-bash\" data-no-translation=\"\">docker run --rm -it vaultwarden\/server:1.37.2 \/vaultwarden hash\n<\/code><\/pre>\n<p>Cole a string <code data-no-translation=\"\">$argon2id$...<\/code> no YAML. No Compose cada <code data-no-translation=\"\">$<\/code> vira <code data-no-translation=\"\">$$<\/code>.<\/p>\n<pre data-no-translation=\"\"><code class=\"language-bash\" data-no-translation=\"\">mkdir -p \/opt\/vaultwarden &amp;&amp; cd \/opt\/vaultwarden\n<\/code><\/pre>\n<pre data-no-translation=\"\"><code class=\"language-yaml\" data-no-translation=\"\"># \/opt\/vaultwarden\/compose.yaml\nservices:\n  vaultwarden:\n    image: vaultwarden\/server:1.37.2\n    container_name: vaultwarden\n    restart: unless-stopped\n    environment:\n      DOMAIN: \"https:\/\/vault.exemplo.com.br\"\n      SIGNUPS_ALLOWED: \"true\"\n      ADMIN_TOKEN: \"$$argon2id$$v=19$$m=65540,t=3,p=4$$COLE_O_HASH\"\n    volumes:\n      - .\/vw-data:\/data\n\n  caddy:\n    image: caddy:2\n    container_name: vw-caddy\n    restart: unless-stopped\n    ports:\n      - \"80:80\"\n      - \"443:443\"\n    volumes:\n      - .\/Caddyfile:\/etc\/caddy\/Caddyfile:ro\n      - caddy_data:\/data\n      - caddy_config:\/config\n    depends_on:\n      - vaultwarden\n\nvolumes:\n  caddy_data:\n  caddy_config:\n<\/code><\/pre>\n<pre data-no-translation=\"\"><code class=\"language-text\" data-no-translation=\"\"># \/opt\/vaultwarden\/Caddyfile\nvault.exemplo.com.br {\n    encode zstd gzip\n    reverse_proxy vaultwarden:80\n}\n<\/code><\/pre>\n<pre data-no-translation=\"\"><code class=\"language-bash\" data-no-translation=\"\"># DNS do dom\u00ednio \u2192 IP desta m\u00e1quina, depois:\ndocker compose up -d\ndocker compose logs -f\n<\/code><\/pre>\n<p>Quem j\u00e1 tem nginx (ISPConfig, etc.) dispensa o servi\u00e7o Caddy: publique o Vaultwarden s\u00f3 em <code data-no-translation=\"\">127.0.0.1:8000<\/code> e fa\u00e7a proxy + Let\u2019s Encrypt no nginx. WebSocket vai na mesma porta 80 do container \u2014 n\u00e3o precisa mais da 3012.<\/p>\n<h2>Primeiro login e travar o cadastro<\/h2>\n<p>Abre <code data-no-translation=\"\">https:\/\/vault.exemplo.com.br<\/code>, crie <strong>a sua<\/strong> conta. Depois feche a porta:<\/p>\n<pre data-no-translation=\"\"><code class=\"language-yaml\" data-no-translation=\"\">SIGNUPS_ALLOWED: \"false\"\n<\/code><\/pre>\n<pre data-no-translation=\"\"><code class=\"language-bash\" data-no-translation=\"\">docker compose up -d\n<\/code><\/pre>\n<p>Convites posteriores saem do painel <code data-no-translation=\"\">\/admin<\/code> (o token que voc\u00ea gerou). Sem <code data-no-translation=\"\">ADMIN_TOKEN<\/code>, o painel nem existe \u2014 e \u00e9 assim que deve ficar se voc\u00ea n\u00e3o for usar.<\/p>\n<p>Ligue 2FA no cofre (TOTP ou FIDO2) no primeiro dia. \u00c9 o mesmo app Bitwarden; a diferen\u00e7a \u00e9 s\u00f3 o servidor.<\/p>\n<h2>Apontar os clientes oficiais<\/h2>\n<p>Em qualquer app Bitwarden: engrenagem \u2192 <strong>Self-hosted<\/strong> \u2192 cole <code data-no-translation=\"\">https:\/\/vault.exemplo.com.br<\/code>. Login com o e-mail da conta que voc\u00ea criou. Extens\u00e3o do browser, celular e CLI (<code data-no-translation=\"\">bw config server<\/code>) usam o mesmo URL.<\/p>\n<p>N\u00e3o reporte bug do Vaultwarden no suporte da Bitwarden Inc. O README \u00e9 expl\u00edcito: issue e discuss\u00e3o v\u00e3o para o GitHub\/Matrix do projeto.<\/p>\n<h2>Backup \u2014 se n\u00e3o tem, n\u00e3o tem cofre<\/h2>\n<p>O volume <code data-no-translation=\"\">.\/vw-data<\/code> \u00e9 o cofre: <code data-no-translation=\"\">db.sqlite3<\/code>, anexos, \u00edcones. Sem isso, senha nenhuma volta. Um cron di\u00e1rio basta:<\/p>\n<pre data-no-translation=\"\"><code class=\"language-bash\" data-no-translation=\"\"># pare o write, copie a pasta, suba de novo\ncd \/opt\/vaultwarden\ndocker compose stop vaultwarden\ntar -C \/opt\/vaultwarden -czf \/backup\/vw-$(date +%F).tar.gz vw-data\ndocker compose start vaultwarden\n<\/code><\/pre>\n<p>Guarde a c\u00f3pia <em>fora<\/em> da m\u00e1quina (outro disco, outro VPS, fita, o que for). Teste restaurar uma vez. O <a href=\"\/es\/2026\/09\/dominando-o-systemd-comandos-essenciais\/\">systemd<\/a> <code data-no-translation=\"\">OnCalendar=<\/code> resolve o agendamento se voc\u00ea n\u00e3o quiser cron.<\/p>\n<h2>Referencias<\/h2>\n<ul>\n<li><a href=\"https:\/\/github.com\/dani-garcia\/vaultwarden\">github.com\/dani-garcia\/vaultwarden<\/a> (AGPL-3.0, v1.37.2)<\/li>\n<li><a href=\"https:\/\/github.com\/dani-garcia\/vaultwarden\/wiki\">Wiki<\/a> \u2014 proxy, admin token, SSO OIDC, imagens<\/li>\n<li><a href=\"https:\/\/bitwarden.com\/download\/\">Clientes oficiais Bitwarden<\/a><\/li>\n<\/ul>\n<p>Um bin\u00e1rio Rust, um volume e HTTPS. O cofre fica no hardware que voc\u00ea controla \u2014 e o app no bolso continua o mesmo.<\/p>","protected":false},"excerpt":{"rendered":"<p>O Vaultwarden \u00e9 um servidor compat\u00edvel com os clientes oficiais do Bitwarden, escrito em Rust. Cabe num Raspberry Pi, gasta dezenas de MB de RAM e libera no self-host o que o Bitwarden oficial cobra: TOTP, Send, organiza\u00e7\u00f5es, emergency access. N\u00e3o \u00e9 o Bitwarden Inc. \u2014 \u00e9 o projeto da comunidade (ex-bitwarden_rs), AGPL-3.0, hoje na &#8230; <a title=\"Vaultwarden: Bitwarden self-hosted no Linux\" class=\"read-more\" href=\"https:\/\/www.linuxpro.com.br\/es\/2026\/09\/vaultwarden-bitwarden-self-hosted\/\" aria-label=\"Read more about Vaultwarden: Bitwarden self-hosted no Linux\">Read more<\/a><\/p>","protected":false},"author":0,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[33,2,120],"tags":[155,156,158,157,154],"class_list":["post-405","post","type-post","status-publish","format-standard","hentry","category-howtos","category-linux","category-servidores","tag-bitwarden","tag-docker","tag-rust","tag-senhas","tag-vaultwarden"],"_links":{"self":[{"href":"https:\/\/www.linuxpro.com.br\/es\/wp-json\/wp\/v2\/posts\/405","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.linuxpro.com.br\/es\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.linuxpro.com.br\/es\/wp-json\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/www.linuxpro.com.br\/es\/wp-json\/wp\/v2\/comments?post=405"}],"version-history":[{"count":3,"href":"https:\/\/www.linuxpro.com.br\/es\/wp-json\/wp\/v2\/posts\/405\/revisions"}],"predecessor-version":[{"id":1107,"href":"https:\/\/www.linuxpro.com.br\/es\/wp-json\/wp\/v2\/posts\/405\/revisions\/1107"}],"wp:attachment":[{"href":"https:\/\/www.linuxpro.com.br\/es\/wp-json\/wp\/v2\/media?parent=405"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.linuxpro.com.br\/es\/wp-json\/wp\/v2\/categories?post=405"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.linuxpro.com.br\/es\/wp-json\/wp\/v2\/tags?post=405"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}