How to Build a Secure Self-Hosted Enterprise Password Manager with Passbolt on a Private VPS

Introduction: The Growing Need for Enterprise Credential Security

In the modern digital landscape, businesses face an unprecedented volume of shared credentials, API keys, and sensitive access tokens. Relying on fragmented methods like spreadsheets, encrypted chats, or consumer-grade password managers introduces severe vulnerabilities and compliance risks. For organizations seeking maximum data sovereignty, a self-hosted solution is the definitive answer.

This guide provides a comprehensive, step-by-step walkthrough for deploying Passbolt—an open-source, enterprise-grade password manager designed specifically for teams—on a private Virtual Private Server (VPS). By hosting your own instance, you retain absolute ownership of your cryptographic keys and data access logs.

Why Choose Passbolt for Your Business?

Passbolt stands out in the crowded password management ecosystem due to its unique architectural choices and focus on collaboration. Built from the ground up for teams, it combines rigorous security protocols with user-friendly sharing mechanisms.

Open Source & Peer-Reviewed: Passbolt's source code is fully transparent, allowing for continuous public auditing and ensuring no hidden backdoors exist.
True Asymmetric Encryption: Utilizing a robust OpenPGP framework, data is encrypted on the client side. The server never sees passwords in plain text.
Granular Access Control: Easily define permissions (Read, Update, Share) for specific users or functional teams within your enterprise.
Seamless Integration: Features robust browser extensions and mobile applications backed by a powerful API for automation.

Prerequisites and System Requirements

Before initiating the installation, ensure your infrastructure meets the following baseline requirements to guarantee stability and security:

VPS Hosting: A clean instance running Ubuntu 22.04 LTS or Ubuntu 24.04 LTS.
Hardware Allocations: Minimum 2 vCPUs, 2GB RAM, and 20GB of SSD storage.
Domain Name: A dedicated domain or subdomain (e.g., passwords.yourcompany.com) with A records pointed to your VPS IP address.
Network Accessibility: Open ports 80 (HTTP) and 443 (HTTPS) in your firewall configurations.

Step 1: System Preparation and Updates

Begin by connecting to your VPS via SSH and updating the package repositories to ensure all system software is current.

sudo apt update && sudo apt upgrade -y

Next, configure a basic firewall using UFW to safeguard your server, allowing only essential web traffic and SSH access:

sudo ufw allow OpenSSH
sudo ufw allow 'Nginx Full'
sudo ufw enable

Step 2: Installing Passbolt via the Official Repository

Passbolt provides an automated installation script that streamlines the configuration of the application environment, database, and SSL certificates via Let's Encrypt. Execute the official setup script with the following command:

wget -O passbolt-ce-installer.sh [https://download.passbolt.com/ce/installer/passbolt-repo-setup.ce.sh](https://download.passbolt.com/ce/installer/passbolt-repo-setup.ce.sh)
sudo bash passbolt-ce-installer.sh

During the execution, the installer will prompt you to select your preferred web server (Nginx is highly recommended) and database management system (MariaDB/MySQL). The script will automatically install the necessary PHP extensions, dependencies, and set up a local database instance if requested.

Step 3: Configuring SSL and Domain Names

Security is paramount for a password manager. Running Passbolt over an unencrypted HTTP connection is a severe risk. The installer natively integrates with Let's Encrypt to provision a free, automated automated SSL/TLS certificate.

Critical Security Note: Always enforce HTTPS. Ensure that your automated certificate renewals are functioning correctly by testing the Certbot cron job.

When prompted by the interactive installer, input your fully qualified domain name and a valid administrative email address. The script will automatically modify your Nginx configuration files to handle SSL termination and force-redirect all insecure traffic to HTTPS.

Step 4: Executing the Web-Based Initialization

Once the command-line setup finishes, navigate to your configured domain using a secure web browser to complete the cryptographic initialization setup.

Environment Validation: Passbolt will run a preliminary health check to confirm server configurations, database connectivity, and SSL status.
Admin Account Creation: Enter the primary administrator's email address and name.
GPG Key Generation: The system will generate a unique OpenPGP keypair for the server and prompt you to generate your personal private key. You must download and securely back up this private key file. Loss of this key means permanent loss of access to your data.
Passphrase Selection: Create a master passphrase. Ensure this adheres to enterprise complexity standards (minimum 16 characters, combining alphanumeric and special characters).

Step 5: Post-Deployment Best Practices and Hardening

To transition your self-hosted Passbolt instance into a production-ready asset, implement these additional security and operational layers:

Automated Backups

A password manager is a single point of failure if data corruption occurs. Implement a daily automated backup strategy that copies the following components to an off-site, encrypted storage location:

The MySQL/MariaDB database dump.
The server configuration files located in /etc/passbolt/.
The public and private GPG keys used by the server avatar systems.

Two-Factor Authentication (2FA)

Enforce multi-factor authentication globally for all corporate users. Passbolt supports TOTP (Time-Based One-Time Password) applications like Google Authenticator or Yubico Authenticator out of the box, mitigating the risk of compromised master passphrases.

Conclusion

By deploying Passbolt on your own private VPS, you successfully eliminate third-party cloud risks and establish a robust, compliant, and highly secure environment for managing organizational secrets. This setup strikes the perfect balance between uncompromising cryptographic security and operational agility, enabling your teams to collaborate safely without bottlenecks.