[{"data":1,"prerenderedAt":167},["ShallowReactive",2],{"seo-verification":3,"blog-passbolt-on-vps-auditable-team-password-vault-no-subscription-en":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"id":7,"slug":8,"slugs":9,"title":12,"excerpt":13,"readTime":14,"views":15,"isPinned":16,"publishedAt":17,"category":18,"categories":24,"featuredImage":26,"bgImage":27,"posterImage":28,"relatedSolution":26,"intro":29,"sections":30,"ctaTitle":117,"ctaBody":118,"ctaButton":119,"ctaUrl":120,"relatedPosts":121},296,"passbolt-on-vps-auditable-team-password-vault-no-subscription",{"fr":10,"en":8,"ar":11},"passbolt-gestionnaire-mots-de-passe-equipe-vps","passbolt-على-vps-خزنة-مرور-للفريق-بلا-اشتراك","Passbolt on VPS: auditable team password vault, no subscription","Deploy Passbolt Community Edition on your VPS with Docker and PostgreSQL: per-recipient GPG encryption, per-entry audit log, REST API — zero SaaS subscription.",10,0,false,"2026-08-23T00:00:00+00:00",{"id":19,"name":20,"slug":21,"color":22,"icon":23},8,"Security & Monitoring","securite-monitoring","bg-rose-500\u002F10 text-rose-400","security",[25],{"id":19,"name":20,"slug":21,"color":22,"icon":23},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fpassbolt-gestionnaire-mots-de-passe-equipe-vps-poster.svg","Team password managers cost 4 to 6 dollars per user per month in 2026, without ever giving you access to the audit log. Passbolt Community Edition (AGPL-3.0) turns a VPS into a team vault: every secret is encrypted with the recipient's GPG key, no password ever transits in clear text, and you always know who looked at what. On a single vCPU with 2 GB of RAM, the entire stack fits — and if the team grows, you scale the server, you don't renegotiate a contract.",[31,35,46,49,71,75,111,114],{"type":32,"title":33,"body":34},"h2","Why self-host your team password manager","A SaaS team secret manager solves the sharing problem but creates another: you control neither where the secrets reside nor who has access on the vendor side. When an employee leaves the agency, revocation depends on how quickly your admin acts on a third-party interface — and the audit log, when it exists, is usually reserved for Enterprise plans.\n\nPassbolt Community Edition reverses this logic: every secret is encrypted on the client side with the recipient's GPG key before it ever reaches the server. Even a system administrator with root access to the database cannot read a password in clear text. The audit log records every consultation per entry and per user — what accounting teams call a non-repudiable trace.",{"type":36,"title":37,"items":38},"ul","What Passbolt CE brings to your agency",[39,40,41,42,43,44,45],"**Per-recipient GPG encryption** — the secret never leaves the client in clear text; the server stores only encrypted data, unreadable without the user's private key.","**Granular audit log** — who consulted, modified or shared each entry, with a timestamp; essential when a team member leaves.","**Per-entry sharing, not per-folder** — share client A's secret with person A only, without exposing client B's secrets.","**Native REST API** — integrate into your CI\u002FCD pipelines to inject secrets on the fly without writing them to the repository.","**Official browser extension** — available on Chrome, Firefox and Edge; fills forms like a SaaS manager.","**Free and open source** (AGPL-3.0) — no user limit on Community Edition, the code is auditable on GitHub.","**Vertical scalability** — if the team doubles, upgrade the VPS; no contract renegotiation, no pricing tier to cross.",{"type":32,"title":47,"body":48},"Requirements for installation","Passbolt CE with PostgreSQL 16 fits in **2 GB of RAM**: plan roughly 1 GB for the Passbolt container and 512 MB for PostgreSQL, with the remainder covering the OS and buffers. A single vCPU is enough for a team of fewer than fifty people.\n\nStack requirements: Docker and Docker Compose installed, a domain name pointing to your VPS (Passbolt refuses to start over HTTP — HTTPS is a prerequisite, not an option), and outbound SMTP access (port 587\u002FSTARTTLS or 465\u002FSSL). Without a configured SMTP server, the container will not start: invitations and account recovery go through email.",{"type":50,"title":51,"steps":52},"steps","Deploying Passbolt CE on your VPS",[53,56,59,62,65,68],{"title":54,"body":55},"Prepare the directory and retrieve the official configuration","Connect to your VPS via SSH and create a dedicated directory:\n\n```bash\nmkdir -p \u002Fopt\u002Fpassbolt && cd \u002Fopt\u002Fpassbolt\ncurl -fsSL https:\u002F\u002Fraw.githubusercontent.com\u002Fpassbolt\u002Fpassbolt_docker\u002Fmaster\u002Fdocker-compose\u002Fdocker-compose-ce.yaml \\\n  -o docker-compose.yml\n```\n\nThis file declares two services: `db` (image `postgres:16`) and `passbolt` (image `passbolt\u002Fpassbolt:latest-ce-non-root`), with two named volumes to persist data. In production, pin a fixed version — replace `latest-ce-non-root` with the latest stable release tag available on the official Docker Hub.",{"title":57,"body":58},"Configure environment variables","Create a `.env` file in the root directory. The minimum required variables:\n\n```bash\nAPP_FULL_BASE_URL=https:\u002F\u002Fpassbolt.yourdomain.com\nDATABASE_HOST=db\nDATABASE_PORT=5432\nDATABASE_NAME=passbolt\nDATABASE_USERNAME=passbolt\nDATABASE_PASSWORD=strong_password\nPOSTGRES_PASSWORD=strong_password\nEMAIL_TRANSPORT_DEFAULT_HOST=smtp.yourprovider.com\nEMAIL_TRANSPORT_DEFAULT_PORT=587\nEMAIL_TRANSPORT_DEFAULT_TLS=true\nEMAIL_TRANSPORT_DEFAULT_USERNAME=your@email.com\nEMAIL_TRANSPORT_DEFAULT_PASSWORD=smtp_password\nEMAIL_DEFAULT_FROM=passbolt@yourdomain.com\n```\n\n`APP_FULL_BASE_URL` must start with `https:\u002F\u002F` — Passbolt uses this value to build links in invitation emails and as the JWT base.",{"title":60,"body":61},"Add a PostgreSQL healthcheck and start the stack","Edit `docker-compose.yml` to add a health condition on the `db` service — without it, Passbolt may start before PostgreSQL is ready to accept connections, causing a restart loop:\n\n```bash\n# In the db service, under the postgres:16 image:\nhealthcheck:\n  test: [\"CMD-SHELL\", \"pg_isready -U passbolt\"]\n  interval: 10s\n  timeout: 5s\n  retries: 5\n\n# In the passbolt service:\ndepends_on:\n  db:\n    condition: service_healthy\n```\n\nThen start the stack:\n\n```bash\ndocker compose up -d\ndocker compose logs -f passbolt\n```\n\nWait for the logs to indicate that GPG configuration has been initialized before proceeding.",{"title":63,"body":64},"Retrieve and note the GPG fingerprint","On first start, Passbolt generates a server-side GPG key pair. Retrieve the fingerprint — you will need it if you need to reconfigure the environment:\n\n```bash\ndocker compose exec passbolt su -s \u002Fbin\u002Fbash -c \\\n  \"gpg --home \u002Fvar\u002Flib\u002Fpassbolt\u002F.gnupg --list-keys\" www-data\n```\n\nThe fingerprint is the 40-character hexadecimal string under the `pub` line. Note it: if `PASSBOLT_GPG_SERVER_KEY_FINGERPRINT` does not match the key in the container's keyring, Passbolt will refuse to start with the error `The OpenPGP server key fingerprint does not match`.",{"title":66,"body":67},"Configure the HTTPS reverse proxy","Passbolt must be served exclusively over HTTPS. If you are using nginx as a reverse proxy on the same VPS, a minimal example configuration:\n\n```bash\nserver {\n    listen 443 ssl;\n    server_name passbolt.yourdomain.com;\n\n    ssl_certificate     \u002Fetc\u002Fletsencrypt\u002Flive\u002Fpassbolt.yourdomain.com\u002Ffullchain.pem;\n    ssl_certificate_key \u002Fetc\u002Fletsencrypt\u002Flive\u002Fpassbolt.yourdomain.com\u002Fprivkey.pem;\n\n    location \u002F {\n        proxy_pass http:\u002F\u002F127.0.0.1:8080;\n        proxy_set_header Host $host;\n        proxy_set_header X-Real-IP $remote_addr;\n        proxy_set_header X-Forwarded-Proto https;\n    }\n}\n```\n\nObtain your certificate with Certbot (`certbot --nginx -d passbolt.yourdomain.com`) before enabling the block. The Passbolt browser extension will not work on an HTTP domain or with a self-signed certificate.",{"title":69,"body":70},"Create the first administrator account","Once the container is running and the domain is accessible over HTTPS, create the administrator account:\n\n```bash\ndocker compose exec passbolt su -s \u002Fbin\u002Fbash www-data \\\n  -c \"\u002Fvar\u002Fwww\u002Fpassbolt\u002Fbin\u002Fcake passbolt register_user \\\n  -u admin@yourdomain.com \\\n  -f FirstName \\\n  -l LastName \\\n  -r admin\"\n```\n\nThe command generates a single-use invitation link. Open it in the browser where the Passbolt extension is installed — the extension will guide the setup of your personal GPG key. Once the administrator is configured, invite team members from the web interface.",{"type":72,"title":73,"body":74},"tip","Hardening: access control, backups and key rotation","Restrict database port access to the Passbolt container only (Docker Networks handles this by default with Compose internal networks). Schedule a daily backup of the PostgreSQL volume with `docker compose exec db pg_dump` to external storage — GPG-encrypted secrets are worthless without the database that indexes them.\n\nFor server GPG key rotation, follow the procedure documented on `docs.passbolt.com`: the interface guides each user to re-encrypt their secrets with the server's new public key. Do not attempt to manually replace keyring files inside the volume — Passbolt will detect a fingerprint mismatch and refuse to start.",{"type":76,"title":77,"headers":78,"rows":82},"comparison","Passbolt CE vs Bitwarden Teams vs Vaultwarden",[79,80,81],"Criterion","Passbolt CE","Bitwarden Teams \u002F Vaultwarden",[83,87,91,95,99,103,107],[84,85,86],"Monthly cost","€0 (self-hosted)","Bitwarden Teams: $4\u002Fuser\u002Fmonth · Vaultwarden: €0 (self-hosted)",[88,89,90],"Encryption","Per-recipient GPG — the server never sees a secret in clear text","AES-256 server-side (Bitwarden and Vaultwarden) — the server decrypts to serve you",[92,93,94],"Per-entry audit log","Yes, native CE — who consulted, modified, shared each secret","Bitwarden Enterprise: yes · Bitwarden Teams: no · Vaultwarden: no",[96,97,98],"Granular sharing","Per entry and per user, with read\u002Fupdate\u002Fowner rights","Per folder (collection) — all or nothing",[100,101,102],"Stable REST API","Yes, documented and versioned — usable in CI\u002FCD","Bitwarden: official API · Vaultwarden: unofficial API, not guaranteed",[104,105,106],"LDAP \u002F Active Directory","Passbolt Pro (paid) · CE: manual invitation only","Bitwarden Enterprise: yes · Vaultwarden: no",[108,109,110],"Browser extension","Official extension Chrome\u002FFirefox\u002FEdge","Bitwarden extension (Vaultwarden-compatible) Chrome\u002FFirefox\u002FEdge\u002FSafari",{"type":32,"title":112,"body":113},"Troubleshooting — real error messages","**`The OpenPGP server key fingerprint does not match`** on startup: the `PASSBOLT_GPG_SERVER_KEY_FINGERPRINT` variable in your `.env` does not match the key in the container's keyring. Check the fingerprint with `gpg --list-keys` inside the container, then update the variable. This typically occurs after recreating the container without persisting the GPG volume.\n\n**`Could not send email`** during an invitation: `EMAIL_TRANSPORT_DEFAULT_HOST` is missing or incorrect, or port 25 is blocked by your VPS (the default at most providers). Switch to port 587 with `EMAIL_TRANSPORT_DEFAULT_TLS=true` (STARTTLS) or port 465 with SSL implicit, depending on your SMTP server's configuration.\n\n**`passbolt` container in `unhealthy` state or restart loop**: run `docker compose logs passbolt` and look for database connection errors. The most common cause is PostgreSQL not yet being ready when Passbolt tried to connect. Add the `depends_on` with `condition: service_healthy` and the `pg_isready` healthcheck on the `db` service (described in step 3).\n\n**Extension not recognized by the browser**: the Passbolt extension requires HTTPS with a valid certificate. Verify that `APP_FULL_BASE_URL` starts with `https:\u002F\u002F` and that the certificate is trusted by your browser. Clear the extension's cache and cookies (`passbolt_data` in the extension's storage) before attempting a new login.",{"type":32,"title":115,"body":116},"Your agency controls its credentials, with no external dependency","Passbolt Community Edition replaces a SaaS subscription with a three-component stack — Docker, PostgreSQL and a reverse proxy — that fits on the VPS you may already have. Per-recipient GPG encryption and per-entry audit logging are not paid options: they are part of the open source core, auditable line by line on GitHub.\n\nWhen a collaborator leaves the agency, you revoke their access in the interface, and the secrets they held remain encrypted with keys they no longer own. That is the fundamental property that tools designed for personal use — Vaultwarden included — cannot offer you.","Your agency manages credentials for multiple clients","An auditable vault on your own VPS prevents an employee departure from becoming a data leak. Explore our VPS plans and the administration option to delegate stack maintenance.","Discover the Agency offer","\u002Fsolutions\u002Fagences",[122,138,151],{"id":123,"slug":124,"slugs":125,"title":128,"excerpt":129,"readTime":130,"views":15,"isPinned":16,"publishedAt":131,"category":132,"categories":133,"featuredImage":26,"bgImage":27,"posterImage":135,"relatedSolution":136},131,"self-host-your-password-manager-deploy-vaultwarden-on-vps",{"fr":126,"en":124,"ar":127},"deploy-vaultwarden-vps","استضف-مدير-كلمات-المرور-بنفسك-انشر-vaultwarden-على-vps","Self-Host Your Password Manager: Deploy Vaultwarden on VPS","Self-host Vaultwarden on a VPS to get unlimited Bitwarden-compatible password management, team vaults and TOTP at a fixed monthly cost — under 50 MB RAM.",5,"2026-06-24T00:00:00+00:00",{"id":19,"name":20,"slug":21,"color":22,"icon":23},[134],{"id":19,"name":20,"slug":21,"color":22,"icon":23},"\u002Fblog\u002Fcovers\u002Fdeploy-vaultwarden-vps-poster.svg",{"categorySlug":23,"appSlug":137},"vaultwarden",{"id":139,"slug":140,"slugs":141,"title":144,"excerpt":145,"readTime":14,"views":15,"isPinned":16,"publishedAt":146,"category":147,"categories":148,"featuredImage":26,"bgImage":27,"posterImage":150,"relatedSolution":26},228,"initial-linux-server-hardening",{"fr":142,"en":140,"ar":143},"durcissement-serveur-linux-initial","تصليب-الخادم-linux-الأولي","Initial Linux Server Hardening","Create a sudo user, configure SSH with keys, enable UFW and fail2ban on Ubuntu 22.04 or Debian 12 in under an hour.","2026-08-06T00:00:00+00:00",{"id":19,"name":20,"slug":21,"color":22,"icon":23},[149],{"id":19,"name":20,"slug":21,"color":22,"icon":23},"\u002Fblog\u002Fcovers\u002Fdurcissement-serveur-linux-initial-poster.svg",{"id":152,"slug":153,"slugs":154,"title":157,"excerpt":158,"readTime":14,"views":15,"isPinned":16,"publishedAt":159,"category":160,"categories":161,"featuredImage":26,"bgImage":27,"posterImage":163,"relatedSolution":164},272,"authentik-authelia-or-keycloak-choosing-your-sso-on-vps",{"fr":155,"en":153,"ar":156},"authentik-vs-authelia-keycloak-sso-vps-2026","authentik-أو-authelia-أو-keycloak-اختيار-sso-على-vps","Authentik, Authelia or Keycloak: Choosing Your SSO on VPS","Authentik, Authelia or Keycloak on VPS: compare real memory footprint, covered protocols and Keycloak 26.7.1 CVEs to choose the right self-hosted SSO.","2026-08-16T00:00:00+00:00",{"id":19,"name":20,"slug":21,"color":22,"icon":23},[162],{"id":19,"name":20,"slug":21,"color":22,"icon":23},"\u002Fblog\u002Fcovers\u002Fauthentik-vs-authelia-keycloak-sso-vps-2026-poster.svg",{"categorySlug":165,"appSlug":166},"cybersecurity-bastion","authentik",1787581065147]