version: '3.7'

services:
  bitwarden:
    image: bitwardenrs/server
    environment:
      WEBSOCKET_ENABLED: 'true' # Required to use websockets
      SIGNUPS_ALLOWED: 'true'   # set to false to disable signups
    networks:
      - default
      - system_traefik
    restart: always
    labels:
      - com.centurylinklabs.watchtower.enable=true
      - traefik.enable=true
      - traefik.docker.network=system_traefik
      - traefik.http.routers.${TRAEFIK_PROJECT}-${TRAEFIK_SERVICE_01}-${TRAEFIK_HASH}.entrypoints=websecure
      - traefik.http.routers.${TRAEFIK_PROJECT}-${TRAEFIK_SERVICE_01}-${TRAEFIK_HASH}.tls=true
      - traefik.http.routers.${TRAEFIK_PROJECT}-${TRAEFIK_SERVICE_01}-${TRAEFIK_HASH}.tls.certresolver=default
      - traefik.http.routers.${TRAEFIK_PROJECT}-${TRAEFIK_SERVICE_01}-${TRAEFIK_HASH}.middlewares=default-security-headers@file
      - traefik.http.routers.${TRAEFIK_PROJECT}-${TRAEFIK_SERVICE_01}-${TRAEFIK_HASH}.service=${TRAEFIK_PROJECT}-${TRAEFIK_SERVICE_01}-${TRAEFIK_HASH}
      - traefik.http.services.${TRAEFIK_PROJECT}-${TRAEFIK_SERVICE_01}-${TRAEFIK_HASH}.loadbalancer.server.port=80
      - traefik.http.routers.${TRAEFIK_PROJECT}-${TRAEFIK_SERVICE_01}-ws-${TRAEFIK_HASH}.entrypoints=websecure
      - traefik.http.routers.${TRAEFIK_PROJECT}-${TRAEFIK_SERVICE_01}-ws-${TRAEFIK_HASH}.tls=true
      - traefik.http.routers.${TRAEFIK_PROJECT}-${TRAEFIK_SERVICE_01}-ws-${TRAEFIK_HASH}.tls.certresolver=default
      - traefik.http.middlewares.${TRAEFIK_PROJECT}-${TRAEFIK_SERVICE_01}-ws-${TRAEFIK_HASH}-strip.stripprefix.prefixes=/notifications/hub
      - traefik.http.routers.${TRAEFIK_PROJECT}-${TRAEFIK_SERVICE_01}-ws-${TRAEFIK_HASH}.middlewares=default-security-headers@file,${TRAEFIK_PROJECT}-${TRAEFIK_SERVICE_01}-ws-${TRAEFIK_HASH}-strip@docker
      - traefik.http.routers.${TRAEFIK_PROJECT}-${TRAEFIK_SERVICE_01}-ws-${TRAEFIK_HASH}.service=${TRAEFIK_PROJECT}-${TRAEFIK_SERVICE_01}-ws-${TRAEFIK_HASH}
      - traefik.http.services.${TRAEFIK_PROJECT}-${TRAEFIK_SERVICE_01}-ws-${TRAEFIK_HASH}.loadbalancer.server.port=3012
    volumes:
      - ./bw-data:/data

volumes:
  app-volume:

networks:
  system_traefik:
    external: true