# Deploy Vaultwarden for a private password vault Review upstream deployment/security requirements and recovery model before storing credentials. Check the named site's prerequisites, task result, backup scope and recovery handoff with xCloud. Canonical: https://xcloud.host/use-cases/workflows/deploy-vaultwarden-for-a-private-password-vault/ Published: 2026-09-30 · Updated: 2026-09-30 · Technical review: 2026-09-30 Evidence: Source reviewed; no production deployment test claimed Editorial owner: xCloud editorial Intent: Review upstream deployment/security requirements and recovery model before storing credentials. For: site-owner, administrator ## Requirements and responsibilities - Name the team, server, hostname, owner and affected users for the Vaultwarden application. Record the current version and the actual business flow that must survive the change. Confirm the current dashboard form, plan eligibility, and server capacity before committing a resource change. A one-click catalog listing is discovery, not permission or proof that the connected MCP profile can install it. Sources: [xCloud agent capability boundaries](https://github.com/xCloudDev/xcloud-agent-skills/blob/main/plugins/xcloud/reference/capability-map.md); [xCloud MCP documentation and connection profiles](https://app.xcloud.host/mcp/docs); [Vaultwarden project backup guidance](https://github.com/dani-garcia/vaultwarden/wiki/Backing-up-your-vault); [xCloud Vaultwarden one-click deployment](https://xcloud.host/docs/vaultwarden-docker-hosting-one-click-xcloud/); [Back up and restore Docker apps](https://xcloud.host/docs/backup-and-restore-docker-apps/); [Docker backup operations and storage constraints](https://github.com/xCloudDev/xcloud-agent-skills/blob/main/plugins/xcloud/skills/sites/reference/docker-backups.md); [xCloud One Click Apps catalog](https://xcloud.host/one-click-apps/) - Prepare a non-sensitive test input and an acceptance record. Keep access to the app administrator and an independent observer where possible; omit secrets from AI prompts and client reports. Sources: [xCloud agent capability boundaries](https://github.com/xCloudDev/xcloud-agent-skills/blob/main/plugins/xcloud/reference/capability-map.md); [xCloud MCP documentation and connection profiles](https://app.xcloud.host/mcp/docs); [Vaultwarden project backup guidance](https://github.com/dani-garcia/vaultwarden/wiki/Backing-up-your-vault); [xCloud Vaultwarden one-click deployment](https://xcloud.host/docs/vaultwarden-docker-hosting-one-click-xcloud/); [Back up and restore Docker apps](https://xcloud.host/docs/backup-and-restore-docker-apps/); [Docker backup operations and storage constraints](https://github.com/xCloudDev/xcloud-agent-skills/blob/main/plugins/xcloud/skills/sites/reference/docker-backups.md); [xCloud One Click Apps catalog](https://xcloud.host/one-click-apps/) - For a Docker app, identify persistent volumes, bind mounts, external databases and app-level export requirements. A Docker backup briefly stops the app, and an in-place restore replaces current state. Agree a maintenance window and owner before any action that interrupts the service or overwrites data. Sources: [xCloud agent capability boundaries](https://github.com/xCloudDev/xcloud-agent-skills/blob/main/plugins/xcloud/reference/capability-map.md); [xCloud MCP documentation and connection profiles](https://app.xcloud.host/mcp/docs); [Vaultwarden project backup guidance](https://github.com/dani-garcia/vaultwarden/wiki/Backing-up-your-vault); [xCloud Vaultwarden one-click deployment](https://xcloud.host/docs/vaultwarden-docker-hosting-one-click-xcloud/); [Back up and restore Docker apps](https://xcloud.host/docs/backup-and-restore-docker-apps/); [Docker backup operations and storage constraints](https://github.com/xCloudDev/xcloud-agent-skills/blob/main/plugins/xcloud/skills/sites/reference/docker-backups.md); [xCloud One Click Apps catalog](https://xcloud.host/one-click-apps/) ## Illustrative situation A small team wants a private Vaultwarden instance for shared credentials. The owner must prove HTTPS, invitation policy and data recovery before storing real secrets. ## Choose the approach - A Vaultwarden admin-panel token controls server settings; it is separate from the vault account master password. Protect both separately. Sources: [xCloud agent capability boundaries](https://github.com/xCloudDev/xcloud-agent-skills/blob/main/plugins/xcloud/reference/capability-map.md); [xCloud MCP documentation and connection profiles](https://app.xcloud.host/mcp/docs); [Vaultwarden project backup guidance](https://github.com/dani-garcia/vaultwarden/wiki/Backing-up-your-vault); [xCloud Vaultwarden one-click deployment](https://xcloud.host/docs/vaultwarden-docker-hosting-one-click-xcloud/); [Back up and restore Docker apps](https://xcloud.host/docs/backup-and-restore-docker-apps/); [Docker backup operations and storage constraints](https://github.com/xCloudDev/xcloud-agent-skills/blob/main/plugins/xcloud/skills/sites/reference/docker-backups.md); [xCloud One Click Apps catalog](https://xcloud.host/one-click-apps/) - Vault data includes database, attachments, configuration and keys; backing up a SQLite file alone may omit attachments and app state. Sources: [xCloud agent capability boundaries](https://github.com/xCloudDev/xcloud-agent-skills/blob/main/plugins/xcloud/reference/capability-map.md); [xCloud MCP documentation and connection profiles](https://app.xcloud.host/mcp/docs); [Vaultwarden project backup guidance](https://github.com/dani-garcia/vaultwarden/wiki/Backing-up-your-vault); [xCloud Vaultwarden one-click deployment](https://xcloud.host/docs/vaultwarden-docker-hosting-one-click-xcloud/); [Back up and restore Docker apps](https://xcloud.host/docs/backup-and-restore-docker-apps/); [Docker backup operations and storage constraints](https://github.com/xCloudDev/xcloud-agent-skills/blob/main/plugins/xcloud/skills/sites/reference/docker-backups.md); [xCloud One Click Apps catalog](https://xcloud.host/one-click-apps/) ## Dashboard and application procedure ### 1. Review vault threat model **Where:** Team access policy and Vaultwarden docs **Permissions:** Authorized xCloud read access to the named team and site; the relevant app or provider owner supplies records outside xCloud. **Inputs:** Users, domain, registration policy, recovery owner **Action:** Decide who may invite users, whether public signup is disabled, and where admin token and recovery exports will be held. **Expected result:** A limited-access design before creation. **Verify:** Confirm a second trusted operator understands recovery custody. **If it fails:** If no secure credential store exists, establish one before generating real vault items. Capability: Confirm requirements and inspect resources Sources: [xCloud MCP documentation and connection profiles](https://app.xcloud.host/mcp/docs); [xCloud agent capability boundaries](https://github.com/xCloudDev/xcloud-agent-skills/blob/main/plugins/xcloud/reference/capability-map.md); [Vaultwarden project backup guidance](https://github.com/dani-garcia/vaultwarden/wiki/Backing-up-your-vault) ### 2. Install at a stable HTTPS host **Where:** xCloud Add site → One-Click Apps **Permissions:** Authorized xCloud site owner with dashboard rights for the exact setting, backup, staging or restore action and a reviewed target. **Inputs:** Vaultwarden template, Docker + NGINX server, domain **Action:** Use the documented dashboard flow for Vaultwarden, review generated environment inputs and save the admin token outside tickets or chat. **Expected result:** A reachable web vault with a recorded site ID. **Verify:** Inspect certificate name and server/site identity before login. **If it fails:** If HTTPS is absent, keep the installation empty and repair routing first. Capability: Install a selected one-click app in xCloud dashboard Sources: [xCloud One Click Apps catalog](https://xcloud.host/one-click-apps/); [xCloud agent capability boundaries](https://github.com/xCloudDev/xcloud-agent-skills/blob/main/plugins/xcloud/reference/capability-map.md) ### 3. Set admin and registration controls **Where:** Vaultwarden administration panel **Permissions:** Authorized Vaultwarden application administrator or delegated role with rights for this task; hosting access alone is insufficient. **Inputs:** Admin token, SMTP provider, signup policy **Action:** Open the administration panel with the server admin token, disable open registration for a private vault, and configure invite mail if needed. **Expected result:** Only intended users can obtain accounts. **Verify:** Attempt a new uninvited signup and send one test invite. **If it fails:** If signup remains open or mail fails, stop onboarding and correct settings. Capability: Configure and test Vaultwarden in its application UI Sources: [Vaultwarden project backup guidance](https://github.com/dani-garcia/vaultwarden/wiki/Backing-up-your-vault); [xCloud Vaultwarden one-click deployment](https://xcloud.host/docs/vaultwarden-docker-hosting-one-click-xcloud/) ### 4. Test a vault account and client **Where:** Vaultwarden web vault and compatible client **Permissions:** Authorized Vaultwarden application administrator or delegated role with rights for this task; hosting access alone is insufficient. **Inputs:** Disposable user account, harmless secret **Action:** Create a non-production vault account, add a dummy item, then sign in from a browser extension or second client and confirm sync. **Expected result:** A functioning vault data path independent of admin panel access. **Verify:** Check item content after logout/login and client sync. **If it fails:** If client cannot sync, inspect exact server URL and HTTPS before importing secrets. Capability: Configure and test Vaultwarden in its application UI Sources: [Vaultwarden project backup guidance](https://github.com/dani-garcia/vaultwarden/wiki/Backing-up-your-vault); [xCloud Vaultwarden one-click deployment](https://xcloud.host/docs/vaultwarden-docker-hosting-one-click-xcloud/) ### 5. Prove recovery scope **Where:** Vaultwarden data inventory and xCloud Docker Backup **Permissions:** Authorized xCloud team/site operator with the discovered write scope for this exact operation and owner approval for its target and interruption. **Inputs:** Database backend, attachments, config, keys, snapshot **Action:** Identify whether SQLite or external DB is used; ensure database and attachment/config paths are protected. Confirm a Completed backup and rehearse a separate test restore. **Expected result:** A recoverable vault before real use. **Verify:** Verify test item and attachment survive restore in isolation. **If it fails:** If only the database survived, do not assume attachments or admin settings can be recovered. Capability: Create and inspect Docker backups Sources: [Back up and restore Docker apps](https://xcloud.host/docs/backup-and-restore-docker-apps/); [Docker backup operations and storage constraints](https://github.com/xCloudDev/xcloud-agent-skills/blob/main/plugins/xcloud/skills/sites/reference/docker-backups.md); [Vaultwarden project backup guidance](https://github.com/dani-garcia/vaultwarden/wiki/Backing-up-your-vault) ## Maintenance - Review this task after app or template updates and at the cadence agreed with the owner. Record failures as dated observations rather than assuming host health proves service health. Sources: [xCloud agent capability boundaries](https://github.com/xCloudDev/xcloud-agent-skills/blob/main/plugins/xcloud/reference/capability-map.md); [xCloud MCP documentation and connection profiles](https://app.xcloud.host/mcp/docs); [Vaultwarden project backup guidance](https://github.com/dani-garcia/vaultwarden/wiki/Backing-up-your-vault); [xCloud Vaultwarden one-click deployment](https://xcloud.host/docs/vaultwarden-docker-hosting-one-click-xcloud/); [Back up and restore Docker apps](https://xcloud.host/docs/backup-and-restore-docker-apps/); [Docker backup operations and storage constraints](https://github.com/xCloudDev/xcloud-agent-skills/blob/main/plugins/xcloud/skills/sites/reference/docker-backups.md); [xCloud One Click Apps catalog](https://xcloud.host/one-click-apps/) - Watch access changes, backup completion, free storage and external providers. Recheck integrations after credential, DNS, mail or source-data changes. Sources: [xCloud agent capability boundaries](https://github.com/xCloudDev/xcloud-agent-skills/blob/main/plugins/xcloud/reference/capability-map.md); [xCloud MCP documentation and connection profiles](https://app.xcloud.host/mcp/docs); [Vaultwarden project backup guidance](https://github.com/dani-garcia/vaultwarden/wiki/Backing-up-your-vault); [xCloud Vaultwarden one-click deployment](https://xcloud.host/docs/vaultwarden-docker-hosting-one-click-xcloud/); [Back up and restore Docker apps](https://xcloud.host/docs/backup-and-restore-docker-apps/); [Docker backup operations and storage constraints](https://github.com/xCloudDev/xcloud-agent-skills/blob/main/plugins/xcloud/skills/sites/reference/docker-backups.md); [xCloud One Click Apps catalog](https://xcloud.host/one-click-apps/) ## Recovery decisions - Before data recovery, identify incident time, completed backup, target and records created after the snapshot. Preserve current evidence and live data before replacement. Sources: [xCloud agent capability boundaries](https://github.com/xCloudDev/xcloud-agent-skills/blob/main/plugins/xcloud/reference/capability-map.md); [xCloud MCP documentation and connection profiles](https://app.xcloud.host/mcp/docs); [Vaultwarden project backup guidance](https://github.com/dani-garcia/vaultwarden/wiki/Backing-up-your-vault); [xCloud Vaultwarden one-click deployment](https://xcloud.host/docs/vaultwarden-docker-hosting-one-click-xcloud/); [Back up and restore Docker apps](https://xcloud.host/docs/backup-and-restore-docker-apps/); [Docker backup operations and storage constraints](https://github.com/xCloudDev/xcloud-agent-skills/blob/main/plugins/xcloud/skills/sites/reference/docker-backups.md); [xCloud One Click Apps catalog](https://xcloud.host/one-click-apps/) - Use the documented dashboard or application recovery procedure with the authorized owner. Repeat the task-specific limited-user check; reconcile newer records before reopening writes. Sources: [xCloud agent capability boundaries](https://github.com/xCloudDev/xcloud-agent-skills/blob/main/plugins/xcloud/reference/capability-map.md); [xCloud MCP documentation and connection profiles](https://app.xcloud.host/mcp/docs); [Vaultwarden project backup guidance](https://github.com/dani-garcia/vaultwarden/wiki/Backing-up-your-vault); [xCloud Vaultwarden one-click deployment](https://xcloud.host/docs/vaultwarden-docker-hosting-one-click-xcloud/); [Back up and restore Docker apps](https://xcloud.host/docs/backup-and-restore-docker-apps/); [Docker backup operations and storage constraints](https://github.com/xCloudDev/xcloud-agent-skills/blob/main/plugins/xcloud/skills/sites/reference/docker-backups.md); [xCloud One Click Apps catalog](https://xcloud.host/one-click-apps/) ## AI handoff Connect an authorized xCloud MCP profile and discover its exact tools and team scope. The packaged REST wrapper is GET-only; use dashboard or app controls for undocumented writes. ### Supported scope - **Confirm requirements and inspect resources** (mcp; read): Discover the connected profile and operation schema first; only teams granted to the connection are visible. Checkpoint: Confirm exact team, server and site identity. Use dashboard\_url returned by the resource; do not invent a dashboard link. Operation identifiers to discover: teams.index, servers.show, sites.show. Scopes: read:servers, read:sites. Sources: [xCloud MCP documentation and connection profiles](https://app.xcloud.host/mcp/docs); [xCloud agent capability boundaries](https://github.com/xCloudDev/xcloud-agent-skills/blob/main/plugins/xcloud/reference/capability-map.md) ### Copyable agent brief ```text Read exact Docker server and Vaultwarden site status, hostname, backup history and app template. Return a secure deployment plan. Do not request admin token or vault master password, claim MCP configures registration, or restore credential data. App owner tests a dummy item. ``` ### Manual checkpoints - Approve exact site, target, cost and any write or maintenance window after inspecting the proposed plan. - An authorized Vaultwarden administrator must configure and test app users, content, integrations and business rules in the app. - Native WordPress staging, backup schedule/settings, push/pull and all restores are dashboard-only; Docker restore is dashboard-only and replaces state. - Reconcile data created after the chosen recovery point before any destructive restore. ## Feature coverage - **vault decision, evidence and task action** (covered): The procedure identifies the authorized task boundary and observable result. Steps: step-1, step-2, step-3, step-4 - **backup, ongoing operation and recovery** (covered): Recovery and maintenance are checked in the task procedure. Steps: step-4, step-5 ## Sources - [xCloud agent capability boundaries](https://github.com/xCloudDev/xcloud-agent-skills/blob/main/plugins/xcloud/reference/capability-map.md) — reviewed 2026-09-30; v4.4.2 package; xCloud v2.8.8 capability review - [xCloud MCP documentation and connection profiles](https://app.xcloud.host/mcp/docs) — reviewed 2026-09-30 - [Vaultwarden project backup guidance](https://github.com/dani-garcia/vaultwarden/wiki/Backing-up-your-vault) — reviewed 2026-09-30 - [xCloud Vaultwarden one-click deployment](https://xcloud.host/docs/vaultwarden-docker-hosting-one-click-xcloud/) — reviewed 2026-09-30 - [Back up and restore Docker apps](https://xcloud.host/docs/backup-and-restore-docker-apps/) — reviewed 2026-09-30 - [Docker backup operations and storage constraints](https://github.com/xCloudDev/xcloud-agent-skills/blob/main/plugins/xcloud/skills/sites/reference/docker-backups.md) — reviewed 2026-09-30; v4.4.2 - [xCloud One Click Apps catalog](https://xcloud.host/one-click-apps/) — reviewed 2026-09-30 ## Continue [Explore all use cases](https://xcloud.host/use-cases/) - [Back up and recover a Docker application](https://xcloud.host/use-cases/operations/docker-backup-and-recovery/)