services:
  vaultwarden:
    extends:
      file: ${TEMPLATES_PATH}
      service: default
    image: vaultwarden/server:latest 
    container_name: vaultwarden 
    ports:
      - 4018:80
    networks:
      - ip6net
    environment:
      DOMAIN: "https://vaultwarden.${PUBLIC_DOMAIN}"
      SIGNUPS_ALLOWED: false
      INVITATIONS_ALLOWED: false
    volumes:
      # - ${SERVICE_PATH}/vaultwarden/data:/data/
      - ${EXTERNAL_STORAGE}/passwords:/data/
    labels:
      # Watchtower
      - "com.centurylinklabs.watchtower.enable=true"
      # Traefik
      - "traefik.enable=true"
      - "traefik.http.routers.vaultwarden.rule=Host(`vaultwarden.${PUBLIC_DOMAIN}`)"
      - "traefik.http.routers.vaultwarden.entrypoints=https"
      - "traefik.http.routers.vaultwarden.tls=true"
      - "traefik.http.routers.vaultwarden.tls.certresolver=myresolver"
      # Middlewares
      - "traefik.http.routers.vaultwarden.middlewares=crowdsec-bouncer@file"