Vaultwarden and Tailscale on a Raspberry Pi Box

The Pi homelab’s most-skipped “first real project”

This blog has covered Pi-hole twice, Home Assistant, running Ollama locally, and even a full k3s cluster – but never the project most 2026 homelab guides actually recommend starting with: Vaultwarden and Tailscale on a Raspberry Pi. It’s a smaller lift than any of those, and it replaces a recurring subscription (a commercial password manager) with something you fully own.

What each piece actually does

• Vaultwarden – a lightweight, Rust-based reimplementation of the Bitwarden server. It speaks the same API as official Bitwarden, so every official Bitwarden client (browser extension, mobile app, desktop app) connects to it without modification. It’s dramatically lighter than the official server, which is exactly why it’s the go-to choice on a Pi.
• Tailscale – a mesh VPN built on WireGuard that gives every device on your account a stable private address, with no port forwarding and nothing exposed to the public internet. Your Pi never needs an open inbound port for this to work from anywhere.

Setup: Vaultwarden via Docker Compose

Docker is the sane way to run this – it isolates the service and makes upgrades a one-line pull. A minimal docker-compose.yml:

services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: unless-stopped
    environment:
      - SIGNUPS_ALLOWED=false
      - WEBSOCKET_ENABLED=true
    volumes:
      - ./vw-data:/data
    ports:
      - "8080:80"

Set SIGNUPS_ALLOWED=false the moment you’ve created your own account – this is the single most important line in that file if this is ever reachable by anyone other than you.

Setup: Tailscale for access without exposure

Install Tailscale directly on the Pi (not just in the container) so the whole device joins your tailnet:

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

Once it’s authenticated, your Pi gets a stable 100.x.x.x address reachable from every other device on your tailnet – phone, laptop, wherever – with zero public exposure. Point your Bitwarden clients at http://<tailscale-ip>:8080 and you’re done; no domain, no reverse proxy, and no certificate to manage unless you want one for browser convenience.

Why Vaultwarden and Tailscale belong together

Skip straight to exposing Vaultwarden on the public internet and you’ve turned “convenient password access” into “the single juiciest target on your home network” – it holds every credential you own. Pairing it with Tailscale removes that trade-off entirely: the service is never internet-facing, but it’s still reachable from anywhere you’d actually want it, phone included.

Hardware and reliability notes

• Any Pi 4 or 5 handles this comfortably – Vaultwarden’s resource footprint is tiny compared to something like Immich
• Run this off an SSD or NVMe rather than a bare SD card if this Pi is doing anything else too – write endurance matters more once you’re also running Home Assistant or Pi-hole alongside it
• Back up the vw-data volume regularly and somewhere off the Pi itself – this single directory is every password you own, and a dead SD card shouldn’t mean starting from zero
• Enable Vaultwarden’s built-in backup/export options periodically as a second line of defence, independent of your volume backup

Where this fits your wider setup

If you’re running Pi-hole and Home Assistant already, Vaultwarden slots into the same Docker host without noticing the extra load, and Tailscale is worth having on that Pi regardless – it’s the same mechanism you’d use to reach Home Assistant remotely without opening it to the world. Once Vaultwarden and Tailscale are running together, it’s genuinely one of the lowest-maintenance self-hosted pairings in a typical homelab: it just sits there working, quietly saving you a subscription every month.