1815beadf4
- Add compose stacks for apps already proxied by Caddy: bento-pdf,
it-tools, paperless-ngx, and beszel-hub (with Makefile targets)
- Remove the unused Vault stack and the drawio Caddyfile block
- Fix Caddyfile gramps upstream to port 80 to match the compose file
- Bring immich and gramps-web up to the shared template pattern
(no-new-privileges, log rotation, memory limits, healthchecks)
- Single-quote vaultwarden SSO_AUDIENCE_TRUSTED so regex values like
^\d{18}$ render as valid YAML
- Move root docs into kebab-case topic folders, rebuild the docs index
to cover every doc, and fix all broken links
52 lines
2.1 KiB
YAML
52 lines
2.1 KiB
YAML
services:
|
|
vaultwarden:
|
|
image: vaultwarden/server:{{VAULTWARDEN_VERSION:-latest}}
|
|
container_name: vaultwarden
|
|
restart: unless-stopped
|
|
environment:
|
|
TZ: "{{TZ}}"
|
|
DOMAIN: "{{VAULTWARDEN_DOMAIN}}"
|
|
SIGNUPS_ALLOWED: "{{VAULTWARDEN_SIGNUPS_ALLOWED:-false}}"
|
|
# Admin panel at /admin — set to an argon2 hash; leave blank to disable
|
|
ADMIN_TOKEN: "{{VAULTWARDEN_ADMIN_TOKEN:-}}"
|
|
# Email (optional — leave all blank to disable)
|
|
SMTP_HOST: "{{EMAIL_HOST:-}}"
|
|
SMTP_FROM: "{{VAULTWARDEN_SMTP_FROM:-}}"
|
|
SMTP_PORT: "{{EMAIL_PORT:-587}}"
|
|
SMTP_SECURITY: "{{VAULTWARDEN_SMTP_SECURITY:-starttls}}"
|
|
SMTP_USERNAME: "{{EMAIL_HOST_USER:-}}"
|
|
SMTP_PASSWORD: "{{EMAIL_HOST_PASSWORD:-}}"
|
|
# Mobile push notifications (register at https://bitwarden.com/host/)
|
|
PUSH_ENABLED: "{{VAULTWARDEN_PUSH_ENABLED:-false}}"
|
|
PUSH_INSTALLATION_ID: "{{VAULTWARDEN_PUSH_ID:-}}"
|
|
PUSH_INSTALLATION_KEY: "{{VAULTWARDEN_PUSH_KEY:-}}"
|
|
# SSO via OIDC (optional — leave SSO_AUTHORITY blank to disable)
|
|
SSO_ENABLED: "{{VAULTWARDEN_SSO_ENABLED:-false}}"
|
|
SSO_ONLY: "{{VAULTWARDEN_SSO_ONLY:-false}}"
|
|
SSO_AUTHORITY: "{{VAULTWARDEN_SSO_AUTHORITY:-}}"
|
|
SSO_CLIENT_ID: "{{VAULTWARDEN_SSO_CLIENT_ID:-}}"
|
|
SSO_CLIENT_SECRET: "{{VAULTWARDEN_SSO_CLIENT_SECRET:-}}"
|
|
SSO_SCOPES: "{{VAULTWARDEN_SSO_SCOPES:-openid email profile offline_access}}"
|
|
SSO_PKCE: "{{VAULTWARDEN_SSO_PKCE:-true}}"
|
|
# Zitadel puts all project app client IDs in aud; trust any 18-digit ID.
|
|
# Single-quoted: the value is a regex and \d is not a valid YAML escape.
|
|
SSO_AUDIENCE_TRUSTED: '{{VAULTWARDEN_SSO_AUDIENCE_TRUSTED:-}}'
|
|
volumes:
|
|
- /etc/localtime:/etc/localtime:ro
|
|
- vaultwarden_data:/data
|
|
ports:
|
|
- "{{VAULTWARDEN_BIND_IP:-0.0.0.0}}:{{VAULTWARDEN_PORT:-8800}}:80"
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
memory: "{{VAULTWARDEN_MEM_LIMIT:-256m}}"
|
|
logging:
|
|
driver: json-file
|
|
options:
|
|
max-file: "{{DOCKERLOGGING_MAXFILE}}"
|
|
max-size: "{{DOCKERLOGGING_MAXSIZE}}"
|
|
|
|
volumes:
|
|
vaultwarden_data:
|