Add vaultwarden.yaml - ADMIN_TOKEN_FILE + DATABASE_URL_FILE via Docker secrets, inline Traefik rule

2026-06-25 16:58:05 -07:00
parent 2b259dec3b
commit 1b45835015
1 changed files with 100 additions and 0 deletions
@@ -0,0 +1,100 @@
+services:
+  Vaultwarden:
+    cap_drop:
+      - "AUDIT_CONTROL"
+      - "BLOCK_SUSPEND"
+      - "DAC_READ_SEARCH"
+      - "IPC_LOCK"
+      - "IPC_OWNER"
+      - "LEASE"
+      - "LINUX_IMMUTABLE"
+      - "MAC_ADMIN"
+      - "MAC_OVERRIDE"
+      - "NET_ADMIN"
+      - "NET_BROADCAST"
+      - "SYSLOG"
+      - "SYS_ADMIN"
+      - "SYS_BOOT"
+      - "SYS_MODULE"
+      - "SYS_NICE"
+      - "SYS_PACCT"
+      - "SYS_PTRACE"
+      - "SYS_RAWIO"
+      - "SYS_RESOURCE"
+      - "SYS_TIME"
+      - "SYS_TTY_CONFIG"
+      - "WAKE_ALARM"
+    command:
+      - "/start.sh"
+    environment:
+      - ADMIN_TOKEN_FILE=/run/secrets/vaultwarden_admin_token
+#      - "SIGNUPS_ALLOWED=false"
+#      - "DOMAIN=https://vault.bryanmail.net"
+      - DATABASE_URL_FILE=/run/secrets/vaultwarden_database_url
+    hostname: "Vaultwarden"
+    image: "vaultwarden/server:latest"
+#    ipc: "private"
+#    logging:
+#      driver: "db"
+#      options: {}
+#    ports:
+#      - "442:443/tcp"
+#      - "84:80/tcp"
+    networks:
+      - traefik_backend
+      - postgresql_db-backend
+#    restart: "always"
+    stdin_open: true
+    tty: true
+    volumes:
+      - "/volume1/docker/Vaultwarden/data:/data"
+    secrets:
+      - vaultwarden_admin_token
+      - vaultwarden_database_url
+    working_dir: "/"
+    deploy:
+      labels:
+#        - com.centurylinklabs.watchtower=true
+        - traefik.enable=true
+        - "traefik.http.routers.vaultwarden.rule=Host(`vault.bryanmail.net`) || Host(`vault.whooshh.net`)"
+        - traefik.http.routers.vaultwarden.tls=true
+        - traefik.http.routers.vaultwarden.tls.certresolver=letsencrypt
+        - traefik.http.routers.vaultwarden.entrypoints=websecure
+#        - traefik.http.routers.vaultwarden.middlewares=crowdsec@file #forwardAuth-authentik@file
+        - traefik.http.services.vaultwarden.loadbalancer.server.port=80
+#       - traefik.http.services.vaultwarden.loadbalancer.passHostHeader=false
+        - traefik.swarm.network=traefik_backend
+      resources:
+        limits:
+          cpus: '4' # Limit to 0.5 CPU core
+          memory: 1G
+
+#  bitwarden-to-keepass:
+#    image:  rogsme/bitwarden-to-keepass:latest
+#    command: >
+#      bash -c '$BW_PATH config server $BITWARDEN_URL && export BW_SESSION=`$BW_PATH login --raw || $BW_PATH unlock --raw`
+#      && $BW_PATH sync
+#      && python3 bitwarden-to-keepass.py
+#      && $BW_PATH lock'
+#    volumes:
+#      - /volume1/docker/Vaultwarden-to-Keepass/exports:/exports
+#      - /volume1/docker/Vaultwarden-to-Keepass/config:/root/.config/Bitwarden CLI'
+#    environment:
+#      - DATABASE_PASSWORD=cHlchLHlT1aR5eE
+##      - DATABASE_KEYFILE=
+#      - BITWARDEN_URL=https://vault.bryanmail.net
+#    deploy:
+#      labels:
+#        - traefik.enable=false
+
+secrets:
+  vaultwarden_admin_token:
+    external: true
+  vaultwarden_database_url:
+    external: true
+
+networks:
+  postgresql_db-backend:
+    external: true
+  traefik_backend:
+    external: true