101 lines
2.8 KiB
YAML
Executable File
101 lines
2.8 KiB
YAML
Executable File
services:
|
|
Vaultwarden:
|
|
cap_drop:
|
|
- "AUDIT_CONTROL"
|
|
- "BLOCK_SUSPEND"
|
|
- "DAC_READ_SEARCH"
|
|
- "IPC_LOCK"
|
|
- "IPC_OWNER"
|
|
- "LEASE"
|
|
- "LINUX_IMMUTABLE"
|
|
- "MAC_ADMIN"
|
|
- "MAC_OVERRIDE"
|
|
- "NET_ADMIN"
|
|
- "NET_BROADCAST"
|
|
- "SYSLOG"
|
|
- "SYS_ADMIN"
|
|
- "SYS_BOOT"
|
|
- "SYS_MODULE"
|
|
- "SYS_NICE"
|
|
- "SYS_PACCT"
|
|
- "SYS_PTRACE"
|
|
- "SYS_RAWIO"
|
|
- "SYS_RESOURCE"
|
|
- "SYS_TIME"
|
|
- "SYS_TTY_CONFIG"
|
|
- "WAKE_ALARM"
|
|
command:
|
|
- "/start.sh"
|
|
environment:
|
|
- ADMIN_TOKEN_FILE=/run/secrets/vaultwarden_admin_token
|
|
# - "SIGNUPS_ALLOWED=false"
|
|
# - "DOMAIN=https://vault.${DOMAIN}"
|
|
- DATABASE_URL_FILE=/run/secrets/vaultwarden_database_url
|
|
hostname: "Vaultwarden"
|
|
image: "vaultwarden/server:latest"
|
|
# ipc: "private"
|
|
# logging:
|
|
# driver: "db"
|
|
# options: {}
|
|
# ports:
|
|
# - "442:443/tcp"
|
|
# - "84:80/tcp"
|
|
networks:
|
|
- traefik_backend
|
|
- postgresql_db-backend
|
|
# restart: "always"
|
|
stdin_open: true
|
|
tty: true
|
|
volumes:
|
|
- "/volume1/docker/Vaultwarden/data:/data"
|
|
secrets:
|
|
- vaultwarden_admin_token
|
|
- vaultwarden_database_url
|
|
working_dir: "/"
|
|
deploy:
|
|
labels:
|
|
# - com.centurylinklabs.watchtower=true
|
|
- traefik.enable=true
|
|
- "traefik.http.routers.vaultwarden.rule=Host(`vault.${DOMAIN}`) || Host(`vault.${ALT_DOMAIN}`)"
|
|
- traefik.http.routers.vaultwarden.tls=true
|
|
- traefik.http.routers.vaultwarden.tls.certresolver=letsencrypt
|
|
- traefik.http.routers.vaultwarden.entrypoints=websecure
|
|
# - traefik.http.routers.vaultwarden.middlewares=crowdsec@file #forwardAuth-authentik@file
|
|
- traefik.http.services.vaultwarden.loadbalancer.server.port=80
|
|
# - traefik.http.services.vaultwarden.loadbalancer.passHostHeader=false
|
|
- traefik.swarm.network=traefik_backend
|
|
resources:
|
|
limits:
|
|
cpus: '4' # Limit to 0.5 CPU core
|
|
memory: 1G
|
|
|
|
# bitwarden-to-keepass:
|
|
# image: rogsme/bitwarden-to-keepass:latest
|
|
# command: >
|
|
# bash -c '$BW_PATH config server $BITWARDEN_URL && export BW_SESSION=`$BW_PATH login --raw || $BW_PATH unlock --raw`
|
|
# && $BW_PATH sync
|
|
# && python3 bitwarden-to-keepass.py
|
|
# && $BW_PATH lock'
|
|
# volumes:
|
|
# - /volume1/docker/Vaultwarden-to-Keepass/exports:/exports
|
|
# - /volume1/docker/Vaultwarden-to-Keepass/config:/root/.config/Bitwarden CLI'
|
|
# environment:
|
|
# - DATABASE_PASSWORD=cHlchLHlT1aR5eE
|
|
## - DATABASE_KEYFILE=
|
|
# - BITWARDEN_URL=https://vault.${DOMAIN}
|
|
# deploy:
|
|
# labels:
|
|
# - traefik.enable=false
|
|
|
|
secrets:
|
|
vaultwarden_admin_token:
|
|
external: true
|
|
vaultwarden_database_url:
|
|
external: true
|
|
|
|
networks:
|
|
postgresql_db-backend:
|
|
external: true
|
|
traefik_backend:
|
|
external: true
|