---

services:
  vaultwarden:
    image: vaultwarden/server:1.35.2
    environment:
      DOMAIN: "https://{{ vaultwarden.url }}"
      ADMIN_TOKEN: "{{ vaultwarden_admin_token_hash.stdout | replace('$', '$$') }}"

      {% if vaultwarden.oidc.issuer | length >= 1 -%}
      SSO_ENABLED: "true"
      SSO_PKCE: "true"
      SSO_AUTHORITY: "{{ vaultwarden.oidc.issuer }}"
      SSO_CLIENT_ID: "{{ vaultwarden.oidc.client_id }}"
      SSO_CLIENT_SECRET: "{{ vaultwarden.oidc.client_secret }}"

      {% endif -%}

      {% if vaultwarden.mail.host | length >= 1 -%}
      SMTP_HOST: "{{ vaultwarden.mail.host }}"
      SMTP_FROM: "{{ vaultwarden.mail.user }}"
      SMTP_FROM_NAME: "{{ vaultwarden.org_name }}"
      SMTP_SECURITY: "starttls"
      SMTP_PORT: "587"
      SMTP_USERNAME: "{{ vaultwarden.mail.user }}"
      SMTP_PASSWORD: "{{ vaultwarden.mail.password }}"
      {% endif -%}
      IP_HEADER: "X-Forwarded-For"
    volumes:
      - ./data/vaultwarden:/data
    networks:
      - proxy
    restart: unless-stopped
    labels:
      traefik.enable: true
      traefik.http.routers.vaultwarden.rule: "Host(`{{ vaultwarden.url }}`)"
      traefik.http.routers.vaultwarden.tls: true
      traefik.http.routers.vaultwarden.priority: 100
      traefik.http.routers.vaultwarden.tls.certResolver: hetzner
      traefik.http.services.vaultwarden-https.loadbalancer.server.port: 80

      traefik.http.routers.vaultwarden-admin.rule: "Host(`{{ vaultwarden.url }}`) && PathPrefix(`/admin`)"
      traefik.http.routers.vaultwarden-admin.middlewares: secure-only@file
      traefik.http.routers.vaultwarden-admin.priority: 200
      traefik.http.routers.vaultwarden-admin.tls: true
      traefik.http.routers.vaultwarden-admin.service: vaultwarden-https

networks:
  proxy:
    name: traefik_exposed
    external: true