services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: unless-stopped
    volumes:
      - ./data:/data
    environment:
      - DOMAIN=${DOMAIN}
      - WEBSOCKET_ENABLED=${WEBSOCKET_ENABLED}
      - SIGNUPS_ALLOWED=${SIGNUPS_ALLOWED}
      - ADMIN_TOKEN=${ADMIN_TOKEN}
      - ROCKET_ADDRESS=0.0.0.0
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=traefik_proxy"
      # Main HTTP router
      - "traefik.http.routers.vaultwarden.rule=Host(`v.storel.xyz`)"
      - "traefik.http.routers.vaultwarden.entrypoints=https"
      - "traefik.http.routers.vaultwarden.tls.certresolver=letsencrypt"
      - "traefik.http.routers.vaultwarden.service=vaultwarden"
      # Service configuration
      - "traefik.http.services.vaultwarden.loadbalancer.server.port=80"
      # WebSocket support for notifications
      - "traefik.http.routers.vaultwarden-websocket.rule=Host(`v.storel.xyz`) && Path(`/notifications/hub`)"
      - "traefik.http.routers.vaultwarden-websocket.entrypoints=https"
      - "traefik.http.routers.vaultwarden-websocket.tls.certresolver=letsencrypt"
      - "traefik.http.routers.vaultwarden-websocket.service=vaultwarden"
      # Headers for proper forwarding
      - "traefik.http.middlewares.vaultwarden-headers.headers.customrequestheaders.X-Forwarded-Proto=https"
      - "traefik.http.routers.vaultwarden.middlewares=vaultwarden-headers"
    networks:
      - traefik_proxy
volumes:
  data:
networks:
  traefik_proxy:
    external: true
