In today’s interconnected digital landscape, data security and efficient information management are paramount. For developers, technical architects, and IT professionals, a robust home lab offers the perfect environment to experiment with and deploy secure, self-hosted solutions. This article will guide you through enhancing your home lab’s capabilities by installing two indispensable tools: Linkwarden, a powerful bookmark manager, and Vaultwarden, a secure password manager, both deployed on a Raspberry Pi using Docker Compose. Moving beyond reliance on third-party services, we’ll establish a foundation for managing your digital life with greater control and privacy.
Before we dive in, here are links to the products used in this article.
– Raspberry Pi 5 16gb: https://t4g.link/raspberrypi
– 128gb MicroSD Card: https://t4g.link/128gbmsd
– Argon ONE V5 Case: https://t4g.link/argonv5
– USB C Card Reader: https://t4g.link/usbccr
Technical Breakdown: Setting Up Linkwarden on Raspberry Pi
Linkwarden is an open-source, self-hosted bookmark management system that allows you to save, categorize, and search your links with advanced features. It’s an excellent alternative to cloud-based bookmarking services, ensuring your valuable resources remain under your control.
Prerequisites for Linkwarden
Before we begin, ensure you have Docker installed on your Raspberry Pi. If Docker is not yet configured, please refer to existing guides on setting up Docker on a Raspberry Pi. We’ll be utilizing Docker Compose for a streamlined deployment.
Directory and Volume Setup
First, let’s establish the necessary directory structure for Linkwarden. We’ll create a main directory for the application and dedicated subdirectories for its persistent data.
sudo mkdir -p /applications/linkwarden
cd /applications/linkwarden
sudo mkdir pgdata data meili_dataThe `/applications/linkwarden` path provides a clean and organized structure for your Docker volumes. `pgdata` will store PostgreSQL data, `data` for Linkwarden’s main application data, and `meili-data` for MeiliSearch’s data.
Docker Compose Configuration for Linkwarden
Next, we’ll create the `docker-compose.yaml` file that orchestrates the Linkwarden application, its PostgreSQL database, and MeiliSearch for efficient indexing.
sudo nano docker-compose.yamlPaste the following configuration, adjusting the port if `3000` or `3500` is already in use on your host system:
services:
postgres:
image: postgres:16-alpine
env_file: .env
restart: always
volumes:
- ./pgdata:/var/lib/postgresql/data
linkwarden:
env_file: .env
environment:
- DATABASE_URL=postgresql://postgres:${POSTGRES_PASSWORD}@postgres:5432/postgres
restart: always
# build: . # uncomment to build from source
image: ghcr.io/linkwarden/linkwarden:latest # comment to build from source
ports:
- 3000:3000
volumes:
- ./data:/data/data
depends_on:
- postgres
- meilisearch
meilisearch:
image: getmeili/meilisearch:v1.12.8
restart: always
env_file:
- .env
volumes:
- ./meili_data:/meili_dataEnvironment Variables for Linkwarden
Linkwarden requires an `.env` file to manage sensitive configurations like database passwords and secret keys. Create this file:
sudo nano .envPopulate it with the following. For `NEXTAUTH_URL`, if you are not using a reverse proxy or domain, `http://localhost:3000` is acceptable as per the video. However, for direct IP access on your local network, you might consider `http://YOUR_RPI_IP_ADDRESS:3000` for clarity, though it’s not strictly necessary if `localhost` resolves internally.
NEXTAUTH_URL=http://localhost:3000/api/v1/auth
NEXTAUTH_SECRET=SUPER_SECRET_PASSWORD #https://t4g.gg/password-generator/
MEILI_MASTER_KEY=ANOTHER_SUPER_SECRET_PASSWORD #https://t4g.gg/password-generator/
POSTGRES_PASSWORD=ANOTHER_SUPER_SECRET_PASSWORD #https://t4g.gg/password-generator/
Important: Use a secure password generator to create long, complex strings for these values. If your generated passwords include special characters, you must enclose the entire password string in double quotes (e.g., `POSTGRES_PASSWORD=”mY!S3cr3tP@ssw0rd”`). For simplicity and to avoid potential parsing issues, avoid special characters in the `.env` file for this specific setup.
Launching Linkwarden
With the `docker-compose.yaml` and `.env` files configured, deploy Linkwarden:
sudo docker compose up -d
This command will pull the necessary Docker images, create the network, and start the three containers in detached mode.
Accessing Linkwarden
Once all containers are running, open a web browser and navigate to `http://YOUR_RPI_IP_ADDRESS:3500` (replace `YOUR_RPI_IP_ADDRESS` with your Raspberry Pi’s actual IP address and `3500` with your chosen port). You should be greeted with the Linkwarden signup page. Create your account and begin organizing your links. You can create collections (categories) for better organization and even tag links for granular search capabilities.
Technical Breakdown: Setting Up Vaultwarden on Raspberry Pi
Vaultwarden is an unofficial, open-source Bitwarden-compatible server implementation. It allows you to self-host your password manager, leveraging the robust Bitwarden client ecosystem while maintaining complete control over your data.
Directory and Volume Setup
Similar to Linkwarden, create a dedicated directory and volume for Vaultwarden.
cd /applications # If not already in /applications
sudo mkdir -p vaultwarden
cd vaultwarden
sudo mkdir vw-data`vw-data` will store all of Vaultwarden’s persistent data, including your encrypted password vault.
Docker Compose Configuration for Vaultwarden
Create the `docker-compose.yaml` for Vaultwarden:
sudo nano docker-compose.yaml
Paste the following, noting the `SIGNUPS_ALLOWED` environment variable and the port mapping.
services:
vaultwarden:
image: vaultwarden/server:latest
container_name: vaultwarden
restart: unless-stopped
environment:
# Set your domain for proper WebSocket support and general configuration
# DOMAIN: "https://your.domain.com"
# Optionally, allow/disallow new signups (default is true)
# SIGNUPS_ALLOWED: "true"
volumes:
# Mount a volume for persistent data storage
- ./vw-data:/data
ports:
# Map container port 80 to host port 8000
- "8000:80"
# Map container WebSocket port 3012 to host port 3012
- "3012:3012"
Critical Note on `SIGNUPS_ALLOWED`: Initially, set this to `true` to allow you to create your first user account. Once your account is registered and you’ve confirmed access, it is highly recommended to set `SIGNUPS_ALLOWED=false` and restart the container (`sudo docker compose restart vaultwarden`) to prevent unauthorized users from creating accounts on your password manager.
Launching Vaultwarden
Deploy Vault Warden with Docker Compose:
sudo docker compose up -d
This will pull the Vaultwarden image and start the container.
Accessing Vault Warden and SSL Configuration
Upon successful deployment, Vaultwarden listens on `http://YOUR_RPI_IP_ADDRESS:8000`. However, attempting to access it directly via HTTP will likely result in an error or a blank page. This is because **Vault Warden strictly requires HTTPS (SSL/TLS certificates) for secure operation.**
To achieve this, you need to set up a reverse proxy, such as Nginx Proxy Manager (NPM), and configure SSL certificates (e.g., via Let’s Encrypt). Check out our article covering Nginx Proxy Manager.
Once the reverse proxy with SSL is correctly configured, navigate to your secured domain (e.g., `https://vault.yourdomain.net`). You will then be able to create your Vaultwarden account.
Integrating with Bitwarden Clients
One of the greatest advantages of Vaultwarden is its compatibility with official Bitwarden clients. You can use the Bitwarden browser extension, desktop application, or mobile app to connect to your self-hosted Vaultwarden instance.
To connect:
1. Open your chosen Bitwarden client (e.g., Chrome extension).
2. Locate the settings or gear icon.
3. Find the “Self-Hosted” or “Server URL” option.
4. Enter the full HTTPS URL of your Vault Warden instance (e.g., `https://vault.yourdomain.net`).
5. Save the settings and then log in using the credentials you created on your Vaultwarden web interface.
You can now securely store and retrieve your passwords through the familiar Bitwarden interface, all while your data resides within your home lab.
Wrap Up
By following this guide, you have successfully deployed Linkwarden and Vaultwarden on your Raspberry Pi, transforming it into a powerful hub for self-hosted password and bookmark managers. This not only enhances your home lab’s capabilities but also significantly boosts your digital security and autonomy by taking control of your critical data. This setup provides a robust foundation, offering the peace of mind that comes with managing your own encrypted passwords and curated links. As you continue to expand your home lab, remember the importance of backups and ongoing security practices to maintain the integrity and accessibility of your self-hosted services. Embrace the power of open-source and self-hosting to build a more secure and efficient digital environment.
Visit HAVOK on Discord to connect with our community, share your Raspberry Pi stories, and explore more tech inspirations.
*If you buy something through any of the links featured in this article I may get a small share of the sale.