Self-Host Your Passwords: Run Vaultwarden on Start9

Step 1: Export Your Bitwarden Vault Securely

Before configuring Vaultwarden, make an encrypted local backup of your existing vault:

1. Open your desktop Bitwarden client and sign in.
2. Navigate to Tools > Export Vault.
3. Choose JSON (Encrypted) as the file format.
4. Select Password-Protected (rather than account-restricted, to ensure seamless migration into Vaultwarden).
5. Enter a strong temporary passphrase and download the file.

Step 2: Install Vaultwarden on Start9

1. In your Start9 dashboard, head to the Marketplace.
2. Select the Start9 Registry and search for Vaultwarden.
3. Click Install.
4. Once installed, generate your Admin Portal Token. Copy this key and store it securely.
5. Start the service.

Step 3: Configure Your Admin Settings & Local Domain

1. Open the Admin Portal from Start9's UI.
2. Enter your generated admin token to access configuration options.
3. Verify your local domain URL (typically https://<server-name>.local:<port>). Ensure your local root certificate is installed on your device so your LAN traffic remains encrypted and trusted.
4. Open the Web Vault and create your primary account with your new master password.

Step 4: Point Your Bitwarden Extension to Your Self-Hosted Server

Vaultwarden is fully compatible with standard Bitwarden client apps and browser extensions:

1. Open your browser's Bitwarden extension.
2. On the login screen, click the Settings gear (or the server selection dropdown).
3. Switch your server environment to Self-Hosted.
4. Paste your Start9 Vaultwarden local URL (e.g., https://your-server.local:8080) and click Save.
5. Log in with the master credentials you just created on your local web vault.

Step 5: Import Credentials & Disable Signups

1. With your extension now connected to your empty local vault, click Import (or go to your local Web Vault under Tools > Import Data).
2. Choose Bitwarden (JSON) and select the encrypted backup file you exported in Step 1.
3. Complete the import. All of your credentials are now stored directly on your Start9 server.
4. Lock Down Signups: In your Start9 service dashboard for Vaultwarden, run the action to Disable Signups and restart the service. This ensures no unauthorized users can create accounts on your server.
5. Securely delete the temporary export file from your computer and empty the trash.

How It Works Day-to-Day

Your devices will cache your encrypted vault locally, meaning your browser extensions and mobile apps remain fully functional even when you are away from home.

When you reconnect to your home network, your devices will automatically sync changes back to your private Start9 node: without ever sending credentials across the public internet.