Lunaris

Appearance

🔒 Vaultwarden + Tailscale Setup Guide (Docker Compose) ​

This guide explains how to securely deploy Vaultwarden (a Bitwarden-compatible password manager) behind Tailscale using Docker Compose. This setup ensures your Vaultwarden instance is accessible only via your private Tailscale network, with no public exposure.

🧩 Overview ​

This setup includes two services:

  1. Tailscale — Creates a secure, private VPN connection to your server.
  2. Vaultwarden — A lightweight, Bitwarden-compatible password manager running on the Tailscale network.

The Vaultwarden service runs inside the Tailscale network namespace (via network_mode: service:tailscale), meaning it is only reachable over Tailscale.

📁 Project Structure ​

text
vaultwarden-tailscale/
│
├── docker-compose.yml
├── .env
├── tailscale_state/ # Persistent Tailscale data
└── vw-data/         # Vaultwarden database and configs

⚙️ Environment Variables (.env) ​

Create a .env file in the same directory as your docker-compose.yml:

dotenv
# ---------------------------
# General Settings
# ---------------------------
SERVICE=vaultwarden

# ---------------------------
# Tailscale Configuration
# ---------------------------
TS_VERSION=latest
TS_AUTHKEY=tskey-xxxxxxxxxxxxxxxxx  # Generate from https://login.tailscale.com/admin/settings/keys

# ---------------------------
# Vaultwarden Configuration
# ---------------------------
VAULTWARDEN_VERSION=latest
VAULTWARDEN_PORT=8080

🐳 Docker Compose File ​

yaml
services:
  tailscale:
    image: tailscale/tailscale:${TS_VERSION}
    container_name: tailscale-${SERVICE}
    restart: unless-stopped
    environment:
      - TS_STATE_DIR=/var/lib/tailscale
    volumes:
      - ./tailscale_state:/var/lib/tailscale
      - /dev/net/tun:/dev/net/tun
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    dns:
      - 1.1.1.1
      - 8.8.8.8
    command: >
      sh -c "
        tailscaled & sleep 8 &&
        tailscale up --authkey=${TS_AUTHKEY} --hostname=${SERVICE} &&
        echo 'Waiting for ${SERVICE}...' &&
        while ! nc -z 127.0.0.1 ${VAULTWARDEN_PORT}; do sleep 2; done &&
        tailscale serve --bg http://127.0.0.1:${VAULTWARDEN_PORT} &&
        tail -f /dev/null
      "

  vaultwarden:
    image: vaultwarden/server:${VAULTWARDEN_VERSION}
    container_name: ${SERVICE}
    restart: unless-stopped
    depends_on:
      - tailscale
    network_mode: service:tailscale
    environment:
      ROCKET_PORT: ${VAULTWARDEN_PORT}
      ROCKET_ADDRESS: 0.0.0.0
      SIGNUPS_ALLOWED: "true"
      WEBSOCKET_ENABLED: "true"
    volumes:
      - ./vw-data:/data

🚀 Setup Instructions ​

  1. Install Docker & Docker Compose

    If not already installed:

    bash
    sudo apt update
sudo apt install docker.io docker-compose -y
sudo systemctl enable --now docker

  2. Create the Directory Structure

    bash
    mkdir -p ~/vaultwarden-tailscale/{tailscale_state,vw-data}
cd ~/vaultwarden-tailscale

  3. Create the .env File

    Follow the example above and add your Tailscale auth key.

  4. Launch the Stack

    bash
    sudo docker compose up -d

  5. Check Status

    bash
    sudo docker compose ps
sudo docker logs tailscale-vaultwarden -f

    TIP

    When you see something like: Serving http://127.0.0.1:8080 over Tailscale... ...your setup is working!

🧠 Access Vaultwarden ​

Once the container is up and connected, you can access your Vaultwarden instance using your Tailscale hostname or IP:

http://vaultwarden.tailnet-name.ts.net

To find your Tailscale hostname or IP:

bash
sudo docker exec -it tailscale-vaultwarden tailscale status

🧹 Maintenance Commands ​

CommandDescription
docker compose up -dStart containers
docker compose downStop containers
docker compose logs -fView logs
docker exec -it tailscale-vaultwarden tailscale statusCheck Tailscale connection
docker exec -it tailscale-vaultwarden tailscale ip -4Get Tailscale IP

🛠️ Notes ​

INFO

  • The Vaultwarden service does not expose any public ports.
  • Tailscale Serve makes Vaultwarden accessible via HTTPS on your Tailscale domain (e.g., https://vaultwarden.tailnet-name.ts.net).
  • If you want to use HTTPS certificates, enable HTTPS in Tailscale Serve via the Tailscale admin console.

🔐 Optional Hardening Tips ​

  • Disable public signups by setting: SIGNUPS_ALLOWED=false

  • Use environment variables for admin settings: ADMIN_TOKEN=<your-strong-admin-token>

  • Restrict access via Tailscale ACLs if needed.

✅ Example Output ​

bash
tailscale serve status
text
Serving:
  https://vaultwarden.tailnet-name.ts.net → http://127.0.0.1:8080

You can now open Vaultwarden from any device in your Tailscale network at that HTTPS URL.

🧾 References ​