services:
  Vaultwarden:
    cap_drop:
      - "AUDIT_CONTROL"
      - "BLOCK_SUSPEND"
      - "DAC_READ_SEARCH"
      - "IPC_LOCK"
      - "IPC_OWNER"
      - "LEASE"
      - "LINUX_IMMUTABLE"
      - "MAC_ADMIN"
      - "MAC_OVERRIDE"
      - "NET_ADMIN"
      - "NET_BROADCAST"
      - "SYSLOG"
      - "SYS_ADMIN"
      - "SYS_BOOT"
      - "SYS_MODULE"
      - "SYS_NICE"
      - "SYS_PACCT"
      - "SYS_PTRACE"
      - "SYS_RAWIO"
      - "SYS_RESOURCE"
      - "SYS_TIME"
      - "SYS_TTY_CONFIG"
      - "WAKE_ALARM"
    command:
      - "/start.sh"
    environment:
      - ADMIN_TOKEN_FILE=/run/secrets/vaultwarden_admin_token
#      - "SIGNUPS_ALLOWED=false"
#      - "DOMAIN=https://vault.${DOMAIN}"
      - DATABASE_URL_FILE=/run/secrets/vaultwarden_database_url
    hostname: "Vaultwarden"
    image: "vaultwarden/server:latest"
#    ipc: "private"
#    logging:
#      driver: "db"
#      options: {}
#    ports:
#      - "442:443/tcp"
#      - "84:80/tcp"
    networks:
      - traefik_backend
      - postgresql_db-backend
#    restart: "always"
    stdin_open: true
    tty: true
    volumes:
      - "/volume1/docker/Vaultwarden/data:/data"
    secrets:
      - vaultwarden_admin_token
      - vaultwarden_database_url
    working_dir: "/"
    deploy:
      labels:
#        - com.centurylinklabs.watchtower=true
        - traefik.enable=true
        - "traefik.http.routers.vaultwarden.rule=Host(`vault.${DOMAIN}`) || Host(`vault.${ALT_DOMAIN}`)"
        - traefik.http.routers.vaultwarden.tls=true
        - traefik.http.routers.vaultwarden.tls.certresolver=letsencrypt
        - traefik.http.routers.vaultwarden.entrypoints=websecure
#        - traefik.http.routers.vaultwarden.middlewares=crowdsec@file #forwardAuth-authentik@file
        - traefik.http.services.vaultwarden.loadbalancer.server.port=80
#       - traefik.http.services.vaultwarden.loadbalancer.passHostHeader=false
        - traefik.swarm.network=traefik_backend
      resources:
        limits:
          cpus: '4' # Limit to 0.5 CPU core
          memory: 1G

# bitwarden-to-keepass:
#  image:  rogsme/bitwarden-to-keepass:latest
#  command: >
#    bash -c '$BW_PATH config server $BITWARDEN_URL && export BW_SESSION=`$BW_PATH login --raw || $BW_PATH unlock --raw`
#    && $BW_PATH sync
#    && python3 bitwarden-to-keepass.py
#    && $BW_PATH lock'
#  volumes:
#    - /volume1/docker/Vaultwarden-to-Keepass/exports:/exports
#    - /volume1/docker/Vaultwarden-to-Keepass/config:/root/.config/Bitwarden CLI'
#  environment:
#    - DATABASE_PASSWORD=cHlchLHlT1aR5eE
##      - DATABASE_KEYFILE=
#    - BITWARDEN_URL=https://vault.${DOMAIN}
#  deploy:
#    labels:
#      - traefik.enable=false

secrets:
  vaultwarden_admin_token:
    external: true
  vaultwarden_database_url:
    external: true

networks:
  postgresql_db-backend:
    external: true
  traefik_backend:
    external: true