version: "2.3" services: vaultwarden: image: vaultwarden/server:1.28.1-alpine restart: unless-stopped user: "{{ docker_user.id }}:{{ docker_user.id }}" volumes: - "{{ app_data_dir }}/vaultwarden/:/data" depends_on: - db labels: - traefik.enable=true - traefik.http.routers.vaultwarden-ui.rule=Host(`vaultwarden.jakehoward.tech`) - traefik.http.routers.vaultwarden-ui.service=vaultwarden-ui - traefik.http.services.vaultwarden-ui.loadbalancer.server.port=80 - traefik.http.routers.vaultwarden-websocket.rule=Host(`vaultwarden.jakehoward.tech`) && Path(`/notifications/hub`) - traefik.http.routers.vaultwarden-websocket.service=vaultwarden-websocket - traefik.http.services.vaultwarden-websocket.loadbalancer.server.port=3012 - traefik.http.middlewares.vaultwarden-ratelimit.ratelimit.average=5 - traefik.http.middlewares.vaultwarden-ratelimit.ratelimit.burst=1000 - traefik.http.middlewares.vaultwarden-compress.compress=true - traefik.http.routers.vaultwarden-ui.middlewares=vaultwarden-ratelimit,vaultwarden-compress - traefik.http.routers.vaultwarden-websocket.middlewares=vaultwarden-ratelimit,vaultwarden-compress environment: - SIGNUPS_ALLOWED=false - DOMAIN=https://vaultwarden.jakehoward.tech - SHOW_PASSWORD_HINT=false - DATABASE_URL=postgres://vaultwarden:{{ vaultwarden_database_password }}@db/vaultwarden - INVITATIONS_ALLOWED=false - ROCKET_WORKERS={{ ansible_processor_nproc // 2 }} - WEBSOCKET_ENABLED=true networks: - default - traefik db: image: postgres:14-alpine restart: unless-stopped volumes: - /mnt/tank/dbs/postgres/vaultwarden/:/var/lib/postgresql/data environment: - POSTGRES_PASSWORD={{ vaultwarden_database_password }} - POSTGRES_USER=vaultwarden networks: traefik: external: true