version: "3.7"

services:
        
###########################################################################
###########################################################################
##
##    Docker Compose File: Vaultwarden Services
##    Function: Run Vaultwarden Services
##
###########################################################################
###########################################################################

  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    hostname: vaultwarden
    restart: unless-stopped
    runtime: runc
    command: /start.sh
    working_dir: /
    volumes:
      - /home/albus/bitwarden_rs:/data
    expose:
      - "3012"
    ports:
      - 5962:80
    environment:
      - ADMIN_TOKEN=$(ADMIN_TOKEN:?err)
      - ROCKET_ENV=staging
      - ROCKET_WORKERS=10
    labels:
      - org.opencontainers.image.version=1.24.0
      - org.opencontainers.image.licenses=GPL-3.0-only
      - org.opencontainers.image.revision=45122bed9e2e48418e74b73c9a50c7608d3b6ac1
      - org.opencontainers.image.url=https://hub.docker.com/r/bitwardenrs/server
      - org.opencontainers.image.created=2022-01-30T21:45:26+00:00
    cap_add:
      - AUDIT_WRITE
      - CHOWN
      - DAC_OVERRIDE
      - FOWNER
      - FSETID
      - KILL
      - MKNOD
      - NET_BIND_SERVICE
      - NET_RAW
      - SETFCAP
      - SETGID
      - SETPCAP
      - SETUID
      - SYS_CHROOT
    cap_drop:
      - AUDIT_CONTROL
      - BLOCK_SUSPEND
      - DAC_READ_SEARCH
      - IPC_LOCK
      - IPC_OWNER
      - LEASE
      - LINUX_IMMUTABLE
      - MAC_ADMIN
      - MAC_OVERRIDE
      - NET_ADMIN
      - NET_BROADCAST
      - SYSLOG
      - SYS_ADMIN
      - SYS_BOOT
      - SYS_MODULE
      - SYS_NICE
      - SYS_PACCT
      - SYS_PTRACE
      - SYS_RAWIO
      - SYS_RESOURCE
      - SYS_TIME
      - SYS_TTY_CONFIG
      - WAKE_ALARM
    networks:
      - proxy
    depends_on:
      mariadb:
        condition: service_healthy
        restart: true
      caddy:
        condition: service_started
        restart: true