version: '3.8'

services:
  vaultwarden:
    image: vaultwarden/server:latest-alpine
    container_name: vaultwarden
    restart: unless-stopped
    networks:
      - traefik-public
      - database-internal
    env_file:
      - .env
    environment:
      DOMAIN: https://vault.ai-impress.com
      SIGNUPS_ALLOWED: 'true'
      INVITATIONS_ALLOWED: 'true'
      SHOW_PASSWORD_HINT: 'false'
      ADMIN_TOKEN: ${ADMIN_TOKEN}
      DATABASE_URL: postgresql://${DB_USER}:${DB_PASSWORD}@postgres-main:5432/vaultwarden
      SMTP_HOST: ${SMTP_HOST}
      SMTP_FROM: ${SMTP_FROM}
      SMTP_PORT: 587
      SMTP_SECURITY: starttls
      SMTP_USERNAME: ${SMTP_USERNAME}
      SMTP_PASSWORD: ${SMTP_PASSWORD}
      SMTP_TIMEOUT: 15
      WEB_VAULT_ENABLED: 'true'
    volumes:
      - vaultwarden-data:/data
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.vaultwarden.rule=Host(`vault.ai-impress.com`)"
      - "traefik.http.routers.vaultwarden.entrypoints=websecure"
      - "traefik.http.routers.vaultwarden.tls.certresolver=cloudflare"
      - "traefik.http.services.vaultwarden.loadbalancer.server.port=80"
      - "traefik.http.routers.vaultwarden.middlewares=security-headers@file"
      
      # Admin panel
      - "traefik.http.routers.vaultwarden-admin.rule=Host(`vault.ai-impress.com`) && PathPrefix(`/admin`)"
      - "traefik.http.routers.vaultwarden-admin.entrypoints=websecure"
      - "traefik.http.routers.vaultwarden-admin.tls.certresolver=cloudflare"

volumes:
  vaultwarden-data:

networks:
  traefik-public:
    external: true
  database-internal:
    external: true
