---

services:
  vaultwarden:
    container_name: vaultwarden
    image: vaultwarden/server:latest
    restart: always
    volumes:
      - .vaultwarden-data:/data
    environment:
      - ADMIN_TOKEN=${ADMIN_TOKEN}
      - WEBSOCKET_ENABLED=true
    networks:
      - frontend
    labels:
      - traefik.enable=true
      - traefik.http.routers.vaultwarden.tls=true
      - traefik.http.services.vaultwarden.loadbalancer.server.port=80
      - traefik.http.routers.vaultwarden.rule=Host(`vault.${DOMAIN}`)
      - traefik.http.routers.vaultwarden.entrypoints=websecure
      - traefik.http.routers.vaultwarden.tls=true
      - traefik.http.routers.vaultwarden.tls.certresolver=cloudflare

volumes:
  .vaultwarden-data:
    driver: local

networks:
  frontend:
    external: true