services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: unless-stopped
    networks:
      - proxy
    environment:
      DOMAIN: "https://${VAULTWARDEN_HOST}"
      SIGNUPS_ALLOWED: "false"
      SSO_ENABLED: "true"
      SSO_ONLY: "true"
      SSO_SIGNUPS_MATCH_EMAIL: "true"
      SSO_AUTHORITY: https://${VAULTWARDEN_SSO_AUTHORITY}
      SSO_CLIENT_ID: ${VAULTWARDEN_SSO_CLIENT_ID}
      SSO_CLIENT_SECRET: ${VAULTWARDEN_SSO_CLIENT_SECRET}
    volumes:
      - ./data/vaultwarden:/data/
    labels:
      - "traefik.enable=true"
      - "traefik.http.services.vaultwarden.loadbalancer.server.port=80"
      - "traefik.http.routers.vaultwarden.rule=Host(`${VAULTWARDEN_HOST}`)"
      - "traefik.http.routers.vaultwarden.entrypoints=websecure"
      - "traefik.http.routers.vaultwarden.tls.certresolver=le"

networks:
  proxy:
    name: proxy
    external: true