#### NETWORKS
networks:
  traefik_front_network:
    external: true
  back_network_vaultwarden:
    driver: bridge
    attachable: true

#### SERVICES
services:
###
  vaultwarden:
    container_name: vaultwarden
    hostname: vaultwarden
    image: vaultwarden/server:latest
    restart: unless-stopped
    volumes:
     - ./data:/data:rw
    environment:
#     - ROCKET_TLS={certs="/ssl/certs/certs.pem",key="/ssl/private/key.pem"}  // Environment variable is specific to the Rocket web server
     - ADMIN_TOKEN=${ADMIN_TOKEN}
     - WEBSOCKET_ENABLED=true
     - SIGNUPS_ALLOWED=${SIGNUPS_ALLOWED}
     - SIGNUPS_VERIFY=${SIGNUPS_VERIFY}
     - REQUIRE_DEVICE_EMAIL=${REQUIRE_DEVICE_EMAIL}
     - INVITATIONS_ALLOWED=${INVITATIONS_ALLOWED}
     - SHOW_PASSWORD_HINT=${SHOW_PASSWORD_HINT}
     - EMAIL_CHANGE_ALLOWED=${EMAIL_CHANGE_ALLOWED}
     - SMTP_HOST=${SMTP_HOST}
     - SMTP_FROM=${SMTP_FROM}
     - SMTP_PORT=${SMTP_PORT}
     - SMTP_SSL=${SMTP_SSL}
     - SMTP_SECURITY=${SMTP_SECURITY}
     - SMTP_AUTH_MECHANISM=${SMTP_MECHANISM}
     - SMTP_USERNAME=${SMTP_USERNAME}
     - SMTP_PASSWORD=${SMTP_PASSWORD}
     - DOMAIN=${DOMAIN}
     - ORG_GROUPS_ENABLED=${ORG_GROUPS_ENABLED}
     - ORG_EVENTS_ENABLED=${ORG_EVENTS_ENABLED}
     - LOG_FILE=${LOG_FILE}
     - LOG_LEVEL=${LOG_LEVEL}
    networks:
      - traefik_front_network
      - back_network_vaultwarden
    labels:
      - "com.centurylinklabs.watchtower.enable=true"
      - "traefik.enable=true"
      - "traefik.docker.network=traefik_front_network"
# HTTP
      - "traefik.http.routers.vaultwarden-http.rule=Host(`vaultwarden.tips-of-mine.com`)"
      - "traefik.http.routers.vaultwarden-http.entrypoints=http"
      - "traefik.http.routers.vaultwarden-http.priority=49"
# HTTPS
      - "traefik.http.routers.vaultwarden-https.rule=Host(`vaultwarden.tips-of-mine.com`)"
      - "traefik.http.routers.vaultwarden-https.entrypoints=https"
      - "traefik.http.routers.vaultwarden-https.tls=true"
      - "traefik.http.routers.vaultwarden-https.priority=50"
      - "traefik.http.routers.vaultwarden-https.service=vaultwarden-https-service"
      - "traefik.http.routers.vaultwarden-https.middlewares=vaultwarden-middlewares"
      - "traefik.http.routers.vaultwarden-https.observability.accesslogs=true"
      - "traefik.http.routers.vaultwarden-https.observability.metrics=true"
      - "traefik.http.routers.vaultwarden-https.observability.tracing=true"
# Middleware
#      - "traefik.http.middlewares.vaultwarden-middlewares.headers.SSLRedirect=true"
      - "traefik.http.middlewares.vaultwarden-middlewares.headers.STSSeconds=15552000"
#      - "traefik.http.middlewares.vaultwarden-middlewares.headers.customResponseHeaders"
#      - "traefik.http.middlewares.vaultwarden-middlewares.headers.browserXSSFilter=true"
#      - "traefik.http.middlewares.vaultwarden-middlewares.headers.contentTypeNosniff=true"
      - "traefik.http.middlewares.vaultwarden-middlewares.headers.forceSTSHeader=true"
#      - "traefik.http.middlewares.vaultwarden-middlewares.headers.SSLHost=tips-of-mine.com"
      - "traefik.http.middlewares.vaultwarden-middlewares.headers.STSIncludeSubdomains=true"
      - "traefik.http.middlewares.vaultwarden-middlewares.headers.STSPreload=true"
# Service
      - "traefik.http.services.vaultwarden-https-service.loadbalancer.server.port=80"
#      - "traefik.http.services.vaultwarden-https-service.loadbalancer.server.scheme=https"
#      - "traefik.http.services.vaultwarden-https-service.loadbalancer.healthcheck.hostname=vaultwarden.tips-of-mine.com"
#      - "traefik.http.services.vaultwarden-https-service.loadbalancer.healthcheck.method=foobar"
#      - "traefik.http.services.vaultwarden-https-service.loadbalancer.healthcheck.timeout=10"
#      - "traefik.http.services.vaultwarden-https-service.loadbalancer.healthcheck.interval=30"