services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: unless-stopped
    env_file:
      - vaultwarden.env
    volumes:
      - vaultwarden_data:/data
    expose:
      - "80"
      - "3012"
    networks:
      - traefik_proxy
    labels:
      # --- Traefik ---
      - "traefik.enable=true"
      - "traefik.http.routers.vaultwarden.rule=Host(`${HOST}`)"
      - "traefik.http.routers.vaultwarden.entrypoints=websecure"
      - "traefik.http.routers.vaultwarden.tls=true"
      - "traefik.http.routers.vaultwarden.tls.certresolver=letsencrypt"
      - "traefik.http.routers.vaultwarden.service=vaultwarden-svc"
      - "traefik.http.services.vaultwarden-svc.loadbalancer.server.port=80"
      - "traefik.http.routers.vaultwarden-ws.rule=Host(`${HOST}`) && Path(`/notifications/hub`)"
      - "traefik.http.routers.vaultwarden-ws.entrypoints=websecure"
      - "traefik.http.routers.vaultwarden-ws.tls=true"
      - "traefik.http.routers.vaultwarden-ws.tls.certresolver=letsencrypt"
      - "traefik.http.routers.vaultwarden-ws.service=vaultwarden-ws-svc"
      - "traefik.http.services.vaultwarden-ws-svc.loadbalancer.server.port=3012"
      # --- Homepage ---
      - "homepage.group=Security"
      - "homepage.name=Vaultwarden"
      - "homepage.icon=vaultwarden.png"
      - "homepage.href=${DOMAIN}"
      - "homepage.description=Passwort-Manager"

volumes:
  vaultwarden_data:
    driver: local

networks:
  traefik_proxy:
    external: true