The Engineer's Private Cloud: Passwords, Photos, Files and More — Hosted on Docker

As a senior software engineer, I spend most of my professional life building things on top of infrastructure someone else owns and controls. At some point I decided to reclaim control of my own personal data from the major tech companies — driven by privacy concerns and the need to be more productive and intentional about my digital life. I wanted tools that worked for me, on my terms, without ads, without telemetry.

Part 1: Initial Deployment with Docker, Coolify, and Vaultwarden

This is the first post in a series. This one covers password management. Future installments will cover photo storage and file management — all running on a single VPS behind a reverse proxy with automatic SSL. Total monthly cost: roughly €8–12.

The Stack

The infrastructure relies on three components:

A server — a Hetzner CAX11 (€4.83/month, ARM-based VPS in Germany)
Docker — enables plug-and-play application deployment without manual configuration
Coolify — a web dashboard for managing deployments, SSL certificates, and domain routing without touching the command line

I chose Hetzner specifically for its EU location, GDPR compliance, and lack of US CLOUD Act exposure.

Setting Up the Server

Step 1 — Generate an SSH Key

ssh-keygen -t ed25519 -f ~/.ssh/hetzner

This generates a private key (never shared) and a public key (deployed to the server).

Step 2 — Create Your Hetzner Server

Create a Hetzner Cloud account, spin up a CAX11 instance, and paste your public key contents into the SSH key field.

To retrieve the public key contents:

cat ~/.ssh/hetzner.pub

Step 3 — Connect to Your Server

ssh -i ~/.ssh/hetzner root@YOUR_SERVER_IP

Step 4 — Set Up the Firewall

ufw allow 22    # SSH
ufw allow 80    # HTTP
ufw allow 443   # HTTPS
ufw enable

This restricts access to essential ports only.

Step 5 — Install Coolify

curl -fsSL https://cdn.coollabs.io/coolify/install.sh | bash

After installation, access the Coolify dashboard at http://YOUR_SERVER_IP:8000 to create an admin account. All subsequent management happens through the browser interface.

A Note on End-to-End Encryption

The applications deployed in this series use end-to-end encryption, meaning:

The server stores only encrypted data blobs
Encryption keys remain on user devices
A server compromise yields only unreadable ciphertext
Even the infrastructure owner cannot access the stored data

The security doesn't live at the server level. It lives at the client level.

Deploying Vaultwarden (Self-Hosted Bitwarden)

Vaultwarden is an unofficial but fully compatible Bitwarden server implementation written in Rust. It needs roughly 50MB of RAM versus 2GB+ for the official server, while maintaining identical AES-256 encryption. The server never sees plaintext passwords.

Step 1 — Deploy via Coolify

Navigate to your project, select New Resource, search for Vaultwarden, and deploy. Coolify pulls the vaultwarden/server:latest Docker image and configures the container internally.

Step 2 — Set Your Domain

After deployment, configure the Vaultwarden service domain as:

https://vault.yourdomain.com

Coolify automatically obtains a Let's Encrypt SSL certificate and configures Traefik routing.

Step 3 — Point Your DNS

Add an A record with your DNS provider:

vault.yourdomain.com → YOUR_SERVER_IP

Optionally, a wildcard record for automatic subdomain routing:

*.yourdomain.com → YOUR_SERVER_IP

Step 4 — Create Your Accounts

Visit https://vault.yourdomain.com and register accounts for every family member who needs access.

Step 5 — Disable Open Registration

Once accounts are created, prevent unauthorized sign-ups by setting Signup Allowed to false in Coolify, then restart the service.

Step 6 — Connect Your Devices

Vaultwarden is just the backend — you keep using the official Bitwarden clients on iOS, Android, browser extensions, and desktop. During setup, open Advanced Settings and point the app at your self-hosted server instead of bitwarden.com:

https://vault.yourdomain.com

Log in, and passwords sync across devices through your own server — no subscription, no third-party dependency, no unexpected policy changes.

What's Next

Part one establishes a self-hosted, end-to-end encrypted password manager on personal German infrastructure at minimal cost. The next post covers photo storage and file management, followed by disaster recovery.

Pricing reflects accuracy at time of publication and is subject to change. Self-hosting requires ongoing responsibility for updates, security, and backups. I have no affiliation with any of the tools mentioned.