---
title: "Deploy Vaultwarden on StackBlaze"
description: "Deploy Vaultwarden with managed PostgreSQL, invitation emails that send, and a public HTTPS URL. Sign-up is closed from the first second: you open the admin panel with a token generated at deploy and invite the people who should have an account. Vaults are encrypted on each device before they reach the server."
category: "security, utilities"
url: https://www.stackblaze.com/templates/vaultwarden
---

# Deploy Vaultwarden

Deploy Vaultwarden with managed PostgreSQL, invitation emails that send, and a public HTTPS URL. Sign-up is closed from the first second: you open the admin panel with a token generated at deploy and invite the people who should have an account. Vaults are encrypted on each device before they reach the server.

**[Deploy Vaultwarden on StackBlaze](https://dashboard.stackblaze.com/new/template/vaultwarden)**

## This stack

- **Vaultwarden**: Web service
- **PostgreSQL**: managed database · TCP:5432
- **Email**: platform add-on

## What you get

- **End-to-end encrypted**: Logins, notes, cards and files are encrypted on your device with a key derived from your master password. The server only ever stores ciphertext.
- **Organizations and collections**: Create an organization for your team, share items through collections and invite members by email. Each member keeps a private vault too.
- **Works with the official apps**: Use the built-in web vault, or the browser extensions, desktop and mobile apps: choose self-hosted and enter your app URL.
- **Live sync**: Changes push to open apps over WebSocket notifications through the StackBlaze edge, so an edit on one device shows up on the others.
- **Generator, attachments and Send**: Generate passwords and passphrases, attach encrypted files to items, and share a secret with anyone through an expiring Send link.
- **Invite only from day one**: Public sign-up is off. Accounts come from invitations you send in the admin panel or from an organization, so nobody can claim your server.

## After you deploy

1. **Open the admin panel**: Go to /admin on your app URL and sign in with ADMIN_PANEL_TOKEN from the app’s Variables in the dashboard. It is hashed with Argon2id when the server starts.
2. **Invite yourself**: Under Users, invite your own email address. The invitation arrives through the Email add-on; its link lets you choose your master password and create the account.
3. **Connect your apps**: Sign in to the web vault at your app URL, or pick self-hosted in a browser extension, desktop or mobile app and enter the same URL. Then invite your team.

## How it is wired

- **PostgreSQL holds the vault**: Accounts, organizations and encrypted items live in the attached PostgreSQL database, with passwords generated at deploy. Redeploys keep every item.
- **Keys and files on the volume**: The server’s signing key, encrypted attachments, Send files and website icons live on a 2 GB volume at /data, so sessions and files survive a redeploy.
- **Mail goes through the Email add-on**: Invitations and account emails send through the platform relay from your project’s sending address. There is no mail server to set up.
- **Rate limited sign-in**: Admin and account logins are rate limited per visitor, and the StackBlaze edge passes the real client address, so one visitor can’t lock out the rest.

## Common questions

### How do I create the first account?

Open /admin on your app URL, sign in with ADMIN_PANEL_TOKEN from the app’s Variables, and invite your own email address under Users. The invitation email lets you set your master password. Sign-up is closed, so this is the only way in until you invite others.

### Can StackBlaze or the server reset my master password?

No. Your master password never leaves your device and your vault is encrypted with it, so nobody can recover it. Write it down somewhere safe, or set up emergency access for someone you trust.

### Which apps can I use?

The web vault at your app URL, plus the Bitwarden browser extensions, desktop and mobile apps. On their login screen choose self-hosted and enter your app URL.

### Does mobile push work?

Apps sync when they open and the web vault and desktop apps get live updates. Instant push to phones needs a free installation id and key from bitwarden.com/host, set as PUSH_ENABLED, PUSH_INSTALLATION_ID and PUSH_INSTALLATION_KEY.

### Where is my data stored?

Encrypted vault items, accounts and organizations are in PostgreSQL. The signing key, attachments and Send files are on the app volume. Both stay when you redeploy.

### Can I use my own domain?

Yes. Attach a custom domain from the dashboard, for example vault.example.com, and set DOMAIN to the new https address so invitation links and apps use it.

### What does it cost?

You pay for the compute, storage and bandwidth Vaultwarden and PostgreSQL use, and for the emails it sends, not per user.


Source: https://github.com/dani-garcia/vaultwarden