version: '3.9'
services:
  vaultwarden:
    image: vaultwarden/server@sha256:2ed1d43b7cd49e2b86b27111ae204c15d6f55c4523a220e3542bf0527fd44bf5
    container_name: vaultwarden_vaultwarden
    restart: "no"
    env_file:
      - path: ./vaultwarden_secrets.env
        required: false
    networks:
      - web
    volumes:
      - $DOCKER_DATA/data:/data
    labels:
      - traefik.http.routers.vaultwarden.rule=Host(`bitwarden.jafner.tools`)
      - traefik.http.routers.vaultwarden.tls.certresolver=lets-encrypt
      - traefik.http.routers.vaultwarden.tls.options=tls12@file
      - traefik.http.routers.vaultwarden.middlewares=securityheaders@file
networks:
  web:
    external: true