Once all requirements are met and preparations complete, you can start installing Bitwarden.
Download the Bitwarden installation script to your server and execute it. A directory ./bwdata will be created relative to the location of bitwarden.sh.
curl -Lso bitwarden.sh "https://func.bitwarden.com/api/dl/?app=self-host&platform=linux" && chmod 700 bitwarden.sh
./bitwarden.sh install
During the installer, first enter the domain name of your Bitwarden instance, typically the configured DNS entry. Then choose whether Let’s Encrypt should generate a free, trusted SSL certificate. If yes, provide an email for expiration notifications. If no, you will be asked about the certificate.
Enter your installation ID and key obtained from Bitwarden. Then select the US or EU region, which is only relevant if you connect a self-hosted instance with a paid subscription.
If you don’t use Let’s Encrypt, you can use an existing certificate by placing the files in ./bwdata/ssl/your.domain and indicating if it’s trusted. Alternatively, you can generate a self-signed certificate, which is recommended only for testing. If you don’t use a certificate, you must place an HTTPS proxy in front of the installation; otherwise, Bitwarden apps won’t work.
After installation, complete the basic configuration via two files. First, edit the environment file at ./bwdata/env/global.override.env. Enter your SMTP server details there, including host, port, SSL, username, and password, so Bitwarden can send verification and organization invitation emails. If you need access to the system admin portal, add an admin email to adminSettings__admins.
...
globalSettings__mail__smtp__host=<placeholder>
globalSettings__mail__smtp__port=<placeholder>
globalSettings__mail__smtp__ssl=<placeholder>
globalSettings__mail__smtp__username=<placeholder>
globalSettings__mail__smtp__password=<placeholder>
...
adminSettings__admins=
...
Test the SMTP configuration with ./bitwarden.sh checksmtp. A correct setup reports success; otherwise, you’ll get hints about missing OpenSSL or incorrect values. Apply changes with ./bitwarden.sh restart.
Next, check the installation parameters in ./bwdata/config.yml. This file controls generated assets and must be adjusted for special environments, e.g., if you work behind a proxy or use alternative ports. Apply changes with ./bitwarden.sh rebuild.
Finally, start the instance with ./bitwarden.sh start. The first start may take some time while Docker pulls images. Use docker ps to check if all containers are healthy. Then open the web vault under your configured domain and register an account if needed. Email verification only works with correctly configured SMTP variables.
Before setting up Bitwarden, you need to prepare your system. This includes updating your operating system and installing all required dependencies. This preparation ensures a stable environment and helps prevent issues during or after installation.
To run your system with the latest software and security updates, first perform an update by running:
sudo apt update && sudo apt upgrade -y
This ensures your system has the latest security patches and software versions before proceeding.
After the update completes, proceed with installing dependencies. Bitwarden runs via multiple Docker containers on your system. Docker must be installed first. Run the following commands:
curl -fsSL https://get.docker.com -o get-docker.sh
sh get-docker.sh
For detailed instructions on installing and using Docker, see our Docker guide.
It is recommended to configure your Linux server with a dedicated bitwarden service account from which Bitwarden is installed and operated. This keeps your Bitwarden instance isolated from other applications on your server.
Create the Bitwarden user and set a strong, unique password for this account.
sudo adduser bitwarden
sudo passwd bitwarden
Create the Docker group if it does not exist and add the Bitwarden user to this group:
sudo groupadd docker
sudo usermod -aG docker bitwarden
Create the working directory, set permissions, and assign ownership to bitwarden:
sudo mkdir /opt/bitwarden
sudo chmod -R 700 /opt/bitwarden
sudo chown -R bitwarden:bitwarden /opt/bitwarden
By default, Bitwarden runs on the host over ports 80 (HTTP) and 443 (HTTPS). Set up a domain with DNS records pointing to the host, e.g., server.example.com, especially if you provide the service over the internet. Avoid using "bitwarden" in the hostname to not unnecessarily reveal the server’s role or software.
Preferred source on Google
