Vaultwarden

services:
  vaultwarden:
    image: docker.io/vaultwarden/server:1.32.5-alpine@sha256:76d46d32ba4120b022e0a69487f9fd79fc52e2765b1650c5c51a5dd912a3c288
    restart: unless-stopped
    environment:
      DOMAIN: https://${VAULTWARDEN_HOST}
      SIGNUPS_ALLOWED: "false"
      ADMIN_TOKEN: ${ADMIN_TOKEN}
      WEBSOCKET_ENABLED: "true"
      SENDS_ALLOWED: "true"
      EMERGENCY_ACCESS_ALLOWED: "true"
      PASSWORD_ITERATIONS: "600000"
      SHOW_PASSWORD_HINT: "false"
      LOG_FILE: /data/vaultwarden.log
      LOG_LEVEL: warn
      ROCKET_PORT: "8080"
    volumes:
      - vaultwarden-data:/data
    healthcheck:
      test:
        - CMD
        - wget
        - -qO-
        - http://127.0.0.1:8080/alive
      interval: 30s
      timeout: 5s
      retries: 3
volumes:
  vaultwarden-data: {}

# Caddyfile for Vaultwarden
# Replace vault.example.com with your real domain. Caddy issues TLS automatically.

vault.example.com {
	encode zstd gzip
	header {
		Strict-Transport-Security "max-age=31536000;"
	}

	reverse_proxy /notifications/hub vaultwarden:8080 {
		header_up Host {host}
		header_up X-Real-IP {remote_host}
	}

	reverse_proxy vaultwarden:8080 {
		header_up Host {host}
		header_up X-Real-IP {remote_host}
	}
}

# Traefik labels for Vaultwarden
# Merge into the vaultwarden service in docker-compose.yml.
# Assumes an external Traefik network named "proxy" and a
# certresolver named "letsencrypt". Replace vault.example.com.

services:
  vaultwarden:
    labels:
      traefik.enable: "true"
      traefik.http.routers.vaultwarden.rule: Host(`vault.example.com`)
      traefik.http.routers.vaultwarden.entrypoints: websecure
      traefik.http.routers.vaultwarden.tls: "true"
      traefik.http.routers.vaultwarden.tls.certresolver: letsencrypt
      traefik.http.services.vaultwarden.loadbalancer.server.port: "8080"
    networks:
      - proxy
      - default
networks:
  proxy:
    external: true