diff --git a/vaultwarden/vaultwarden.yaml b/vaultwarden/vaultwarden.yaml
new file mode 100644
index 0000000..3330846
--- /dev/null
+++ b/vaultwarden/vaultwarden.yaml
@@ -0,0 +1,69 @@
+services:
+  Vaultwarden:
+    cap_drop:
+      - "AUDIT_CONTROL"
+      - "BLOCK_SUSPEND"
+      - "DAC_READ_SEARCH"
+      - "IPC_LOCK"
+      - "IPC_OWNER"
+      - "LEASE"
+      - "LINUX_IMMUTABLE"
+      - "MAC_ADMIN"
+      - "MAC_OVERRIDE"
+      - "NET_ADMIN"
+      - "NET_BROADCAST"
+      - "SYSLOG"
+      - "SYS_ADMIN"
+      - "SYS_BOOT"
+      - "SYS_MODULE"
+      - "SYS_NICE"
+      - "SYS_PACCT"
+      - "SYS_PTRACE"
+      - "SYS_RAWIO"
+      - "SYS_RESOURCE"
+      - "SYS_TIME"
+      - "SYS_TTY_CONFIG"
+      - "WAKE_ALARM"
+    command:
+      - "/start.sh"
+    environment:
+      - ADMIN_TOKEN_FILE=/run/secrets/vaultwarden_admin_token
+      - DATABASE_URL_FILE=/run/secrets/vaultwarden_database_url
+    hostname: "Vaultwarden"
+    image: "vaultwarden/server:latest"
+    networks:
+      - traefik_backend
+      - postgresql_db-backend
+    stdin_open: true
+    tty: true
+    volumes:
+      - "/volume1/docker/Vaultwarden/data:/data"
+    secrets:
+      - vaultwarden_admin_token
+      - vaultwarden_database_url
+    working_dir: "/"
+    deploy:
+      labels:
+        - traefik.enable=true
+        - "traefik.http.routers.vaultwarden.rule=Host(`vault.${DOMAIN}`) || Host(`vault.${ALT_DOMAIN}`)"
+        - traefik.http.routers.vaultwarden.tls=true
+        - traefik.http.routers.vaultwarden.tls.certresolver=letsencrypt
+        - traefik.http.routers.vaultwarden.entrypoints=websecure
+        - traefik.http.services.vaultwarden.loadbalancer.server.port=80
+        - traefik.swarm.network=traefik_backend
+      resources:
+        limits:
+          cpus: '4' # Limit to 0.5 CPU core
+          memory: 1G
+
+secrets:
+  vaultwarden_admin_token:
+    external: true
+  vaultwarden_database_url:
+    external: true
+
+networks:
+  postgresql_db-backend:
+    external: true
+  traefik_backend:
+    external: true