networks:
  reverse-proxy:
    external: true

services:
  vaultwarden:
    image: vaultwarden/server:latest
    restart: unless-stopped
    networks:
      - reverse-proxy
    volumes:
      - ./data:/data
    environment:
      DOMAIN: https://${COMPOSE_PROJECT_NAME}.lucascott.com
      # https://github.com/dani-garcia/vaultwarden/wiki/Enabling-admin-page
      # ADMIN_TOKEN_FILE: /run/secrets/admin-token
      # https://github.com/dani-garcia/vaultwarden/wiki/Enabling-Mobile-Client-push-notification
      PUSH_ENABLED: true
      PUSH_INSTALLATION_ID: ${PUSH_INSTALLATION_ID}
      PUSH_INSTALLATION_KEY_FILE: /run/secrets/push-installation-key
      PUSH_RELAY_URI: https://api.bitwarden.eu
      PUSH_IDENTITY_URI: https://identity.bitwarden.eu
    secrets:
      - admin-token
      - push-installation-key
    labels:
      - traefik.enable=true
      - traefik.http.routers.${COMPOSE_PROJECT_NAME}.rule=Host(`${COMPOSE_PROJECT_NAME}.lucascott.com`)
      - traefik.http.routers.${COMPOSE_PROJECT_NAME}.entrypoints=websecure
      - traefik.http.routers.${COMPOSE_PROJECT_NAME}.tls=true
      - traefik.http.routers.${COMPOSE_PROJECT_NAME}.tls.certresolver=letsencrypt-dns
      - traefik.http.routers.${COMPOSE_PROJECT_NAME}.tls.domains[0].sans=*.lucascott.com
      - traefik.http.routers.${COMPOSE_PROJECT_NAME}.middlewares=internalOnly@file
      - wud.watch.digest=true
      - wud.link.template=https://github.com/dani-garcia/vaultwarden/releases

secrets:
  admin-token:
    file: ./admin-token.secret
  push-installation-key:
    file: ./push-installation-key.secret