services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: unless-stopped
    ports:
      - "8081:80"
    environment:
      DOMAIN: ${DOMAIN}
      TZ: "Europe/Berlin"
      LOG_LEVEL: "warn"
      LOG_FILE: "/data/vaultwarden.log"
      WEBSOCKET_ENABLED: "true"
      SIGNUPS_ALLOWED: "false"
      SIGNUPS_VERIFY: "false"
      # Admin-Panel — Argon2-Hash empfohlen:
      # docker exec -it vaultwarden /vaultwarden hash --preset owasp
      ADMIN_TOKEN: ${ADMIN_TOKEN}
    volumes:
      - ${DATA_ROOT}:/data
    networks:
      - vaultwarden_net

networks:
  vaultwarden_net:
    driver: bridge