# Managed by Ansible — do not edit manually
services:
  vaultwarden:
    image: vaultwarden/server:{{ vaultwarden_version }}
    container_name: vaultwarden
    restart: unless-stopped
    environment:
      DOMAIN: "https://{{ domain_vault }}"
      # Admin panel at /admin/ — use a long random token
      ADMIN_TOKEN: "{{ vaultwarden_admin_token }}"
      # Disable public sign-up — accounts created via SSO or admin panel
      SIGNUPS_ALLOWED: "false"
{% if vaultwarden_sso_client_secret | default('') %}
      # SSO via Keycloak — enabled after Keycloak client is configured (step 2.6)
      SSO_ENABLED: "true"
      SSO_CLIENT_ID: "vaultwarden"
      SSO_CLIENT_SECRET: "{{ vaultwarden_sso_client_secret }}"
      SSO_AUTHORITY: "https://{{ domain_sso }}/realms/ladkau"
{% else %}
      SSO_ENABLED: "false"
{% endif %}
    volumes:
      - {{ vaultwarden_data_dir }}/data:/data
    networks:
      - traefik_public
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.vaultwarden.rule=Host(`{{ domain_vault }}`)"
      - "traefik.http.routers.vaultwarden.entrypoints=websecure"
      - "traefik.http.routers.vaultwarden.tls.certresolver=letsencrypt"
      - "traefik.http.services.vaultwarden.loadbalancer.server.port=80"
      # Lax rate limit — Vaultwarden SPA loads many assets on first visit
      - "traefik.http.routers.vaultwarden.middlewares=rate-limit-lax@docker"

networks:
  traefik_public:
    external: true