Passbolt on VPS: auditable team password vault, no subscription

Connect to your VPS via SSH and create a dedicated directory:

mkdir -p /opt/passbolt && cd /opt/passbolt
curl -fsSL https://raw.githubusercontent.com/passbolt/passbolt_docker/master/docker-compose/docker-compose-ce.yaml \
  -o docker-compose.yml

This file declares two services: db (image postgres:16) and passbolt (image passbolt/passbolt:latest-ce-non-root), with two named volumes to persist data. In production, pin a fixed version — replace latest-ce-non-root with the latest stable release tag available on the official Docker Hub.

Create a .env file in the root directory. The minimum required variables:

APP_FULL_BASE_URL=https://passbolt.yourdomain.com
DATABASE_HOST=db
DATABASE_PORT=5432
DATABASE_NAME=passbolt
DATABASE_USERNAME=passbolt
DATABASE_PASSWORD=strong_password
POSTGRES_PASSWORD=strong_password
EMAIL_TRANSPORT_DEFAULT_HOST=smtp.yourprovider.com
EMAIL_TRANSPORT_DEFAULT_PORT=587
EMAIL_TRANSPORT_DEFAULT_TLS=true
[email protected]
EMAIL_TRANSPORT_DEFAULT_PASSWORD=smtp_password
[email protected]

APP_FULL_BASE_URL must start with https:// — Passbolt uses this value to build links in invitation emails and as the JWT base.

Edit docker-compose.yml to add a health condition on the db service — without it, Passbolt may start before PostgreSQL is ready to accept connections, causing a restart loop:

# In the db service, under the postgres:16 image:
healthcheck:
  test: ["CMD-SHELL", "pg_isready -U passbolt"]
  interval: 10s
  timeout: 5s
  retries: 5

# In the passbolt service:
depends_on:
  db:
    condition: service_healthy

Then start the stack:

docker compose up -d
docker compose logs -f passbolt

Wait for the logs to indicate that GPG configuration has been initialized before proceeding.

On first start, Passbolt generates a server-side GPG key pair. Retrieve the fingerprint — you will need it if you need to reconfigure the environment:

docker compose exec passbolt su -s /bin/bash -c \
  "gpg --home /var/lib/passbolt/.gnupg --list-keys" www-data

The fingerprint is the 40-character hexadecimal string under the pub line. Note it: if PASSBOLT_GPG_SERVER_KEY_FINGERPRINT does not match the key in the container's keyring, Passbolt will refuse to start with the error The OpenPGP server key fingerprint does not match.

Passbolt must be served exclusively over HTTPS. If you are using nginx as a reverse proxy on the same VPS, a minimal example configuration:

server {
    listen 443 ssl;
    server_name passbolt.yourdomain.com;

    ssl_certificate     /etc/letsencrypt/live/passbolt.yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/passbolt.yourdomain.com/privkey.pem;

    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-Proto https;
    }
}

Obtain your certificate with Certbot (certbot --nginx -d passbolt.yourdomain.com) before enabling the block. The Passbolt browser extension will not work on an HTTP domain or with a self-signed certificate.

Once the container is running and the domain is accessible over HTTPS, create the administrator account:

docker compose exec passbolt su -s /bin/bash www-data \
  -c "/var/www/passbolt/bin/cake passbolt register_user \
  -u [email protected] \
  -f FirstName \
  -l LastName \
  -r admin"

The command generates a single-use invitation link. Open it in the browser where the Passbolt extension is installed — the extension will guide the setup of your personal GPG key. Once the administrator is configured, invite team members from the web interface.