services:
  Vaultwarden:
    cap_drop:
      - "AUDIT_CONTROL"
      - "BLOCK_SUSPEND"
      - "DAC_READ_SEARCH"
      - "IPC_LOCK"
      - "IPC_OWNER"
      - "LEASE"
      - "LINUX_IMMUTABLE"
      - "MAC_ADMIN"
      - "MAC_OVERRIDE"
      - "NET_ADMIN"
      - "NET_BROADCAST"
      - "SYSLOG"
      - "SYS_ADMIN"
      - "SYS_BOOT"
      - "SYS_MODULE"
      - "SYS_NICE"
      - "SYS_PACCT"
      - "SYS_PTRACE"
      - "SYS_RAWIO"
      - "SYS_RESOURCE"
      - "SYS_TIME"
      - "SYS_TTY_CONFIG"
      - "WAKE_ALARM"
    command:
      - "/start.sh"
    environment:
      - ADMIN_TOKEN_FILE=/run/secrets/vaultwarden_admin_token
      - DATABASE_URL_FILE=/run/secrets/vaultwarden_database_url
    hostname: "Vaultwarden"
    image: "vaultwarden/server:latest"
    networks:
      - traefik_backend
      - postgresql_db-backend
    stdin_open: true
    tty: true
    volumes:
      - "/volume1/docker/Vaultwarden/data:/data"
    secrets:
      - vaultwarden_admin_token
      - vaultwarden_database_url
    working_dir: "/"
    deploy:
      labels:
        - traefik.enable=true
        - "traefik.http.routers.vaultwarden.rule=Host(`vault.${DOMAIN}`) || Host(`vault.${ALT_DOMAIN}`)"
        - traefik.http.routers.vaultwarden.tls=true
        - traefik.http.routers.vaultwarden.tls.certresolver=letsencrypt
        - traefik.http.routers.vaultwarden.entrypoints=websecure
        - traefik.http.services.vaultwarden.loadbalancer.server.port=80
        - traefik.swarm.network=traefik_backend
      resources:
        limits:
          cpus: '4' # Limit to 0.5 CPU core
          memory: 1G

secrets:
  vaultwarden_admin_token:
    external: true
  vaultwarden_database_url:
    external: true

networks:
  postgresql_db-backend:
    external: true
  traefik_backend:
    external: true