G.L.I.T.C.H

Home Server Setup Guide (Part 4): Self-Hosting Passwords with Vaultwarden and Tailscale

4 min read HomeLab

Now that your old laptop is a server, let’s make it truly useful. In this guide, I’ll show you how to host your own password manager with Vaultwarden and secure it with Tailscale. Plus, To enhance privacy, we’ll configure Tailscale with GitHub authentication. Ready to take control of your passwords?

In Part 3, we installed NixOS. Now, let’s use that server to store passwords securely with Vaultwarden and connect to it privately using Tailscale.

Why Host Your Own Password Service?

Passwords are the keys to your digital life—email, banking, social media, everything. Relying on third-party password managers (e.g., LastPass, 1Password) means trusting someone else with those keys. Here’s why self-hosting is a game-changer:
  • Control: You own the server, so you decide where your data lives—no cloud breaches to worry about.
  • Privacy: No Big Tech snooping. Your passwords stay on your hardware.
  • Customization: Tailor the setup to your needs (e.g., backups, access rules).
  • Cost: Free and open-source tools like Vaultwarden save you subscription fees.

Enter Vaultwarden

Vaultwarden is a lightweight, open-source password manager compatible with Bitwarden clients (apps, browser extensions). It’s perfect for a home server because: - It’s resource-efficient—runs fine on an old laptop. - It supports multiple users, ideal for family or small teams. - It’s secure by default with end-to-end encryption.

What Is Tailscale?

Tailscale is a zero-config VPN that creates a secure, private network between your devices using WireGuard. No need to mess with router ports or firewalls—it just works. Here’s why it’s key for our setup:
  • Secure Access: Connect to your Vaultwarden server from anywhere as if you’re on the same LAN.
  • Simplicity: No complex VPN configs—just install and go.
  • Privacy: Encrypted connections without exposing your server to the public internet.

Tailscale Network Flow

Here’s how your devices connect to the server with Tailscale:
┌──────────────┐         ┌──────────────┐
│ Mobile/Laptop│ ────>   | Tailscale    |
│ (100.x.x.x)  │         │  Virtual VPN │
└──────────────┘         └──────────────┘
                                   │
                                   ▼
                          ┌───────────────────┐
                          │  Vaultwarden      │
                          │  Self-hosted PM   │
                          │  (100.x.x.x)      │
                          └───────────────────┘

Step 1: Install Vaultwarden on Your NixOS Server

Assuming your server is running NixOS, let’s set up Vaultwarden. Add Vaultwarden to configuration.nix

  • Edit your config:

sudo nano /etc/nixos/configuration.nix

  • Add this block:


services.vaultwarden = {
    enable = true;
    config = {
      DOMAIN = " ";  # Tailscale HTTPS URL
      SIGNUPS_ALLOWED = true; # After creating the admin account in vaultwarden make this to false
      WEBSOCKET_ENABLED = true;
      ROCKET_ADDRESS = "0.0.0.0";  # Listen on all interfaces
      ROCKET_PORT = 8000;  # Default Vaultwarden port
    };
  };

  networking.firewall.allowedTCPPorts = [ 80 ];

  • Apply changes:

sudo nixos-rebuild switch

Mistake I Faced: I forgot to open port 80 in the firewall—Vaultwarden wasn’t accessible until I added it.

Step 2: Set Up Tailscale with GitHub Authentication

We’ll use Tailscale to access Vaultwarden remotely, and authenticate with a GitHub account (not Google) for added security and privacy.

Install Tailscale on NixOS

  • Add to configuration.nix:

services.tailscale.enable = true;

  • Rebuild:

sudo nixos-rebuild switch

Create a GitHub Account for Tailscale

I created a new GitHub account, to avoid linking my Tailscale activity to Big Tech (Google/Microsoft). It’s a blend of anonymity and deep system traces—perfect for this setup.

  • Sign up at github.com with a secure email (e.g., ProtonMail)

Authenticate Tailscale with GitHub

  • Start Tailscale:

sudo tailscale up

  • A browser window will open. Choose “Sign in with GitHub” and log in with your Github account.

  • Authorize Tailscale to access your GitHub profile.

Verify Tailscale Status

  • Check connected devices:

sudo tailscale status

Step 3: Install Tailscale on Your Client Device

To access Vaultwarden from your phone or laptop, install Tailscale on that device too.

  • Linux: sudo apt install tailscale (or equivalent).

  • Windows/Mac: Download from Tailscale.

  • Mobile: Get the app from App Store/Google Play.

Step 4: Connect to Vaultwarden via Tailscale

Tailscale’s MagicDNS makes connecting to your server effortless by assigning it a memorable domain name—no need to juggle IP addresses. Here’s how it works and how to use it:
  • Check your server’s Tailscale details:
tailscale status

Example output: 100.64.1.2 vaultserver orca-lizard.ts.net. The name (e.g., vaultserver.orca-lizard.ts.net) is your server’s MagicDNS domain, automatically generated from its machine name (vaultserver) and your tailnet name (orca-lizard.ts.net).

  • Ensure MagicDNS is enabled:

    • Log in to the Tailscale admin console at login.tailscale.com.
    • Go to the DNS tab and verify MagicDNS is toggled on (it’s enabled by default for new tailnets).

  • Connect to Vaultwarden:

    • Open your Bitwarden client (mobile app, desktop app, or browser extension).
    • Go to the settings and set the custom server URL to your server’s Tailscale MagicDNS name, e.g., http://vaultserver.orca-lizard.ts.net . Save the settings.
    • Log in with your Vaultwarden credentials to access your password vault.

Next time, I’ll explore adding Pi-hole for ad-blocking on my server. Stay tuned!