vaultwarden:
    container_name: vaultwarden
    image: vaultwarden/server:latest
    # user:  "1000:1000"
    volumes:
      - '${DOCKER_VOLUMES_FOLDER}/vaultwarden/:/data/'
    restart: unless-stopped
    environment:
      - ADMIN_TOKEN=${ADMIN_TOKEN}
    networks:
      proxy:
        ipv4_address: 172.25.0.13
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.vaultwarden.entrypoints=http"
      - "traefik.http.routers.vaultwarden.rule=Host(`vaultwarden.domain.com`)"
      - "traefik.http.middlewares.vaultwarden-https-redirect.redirectscheme.scheme=https"
      - "traefik.http.middlewares.sslheader.headers.customrequestheaders.X-Forwarded-Proto=https"

      - "traefik.http.routers.vaultwarden.middlewares=vaultwarden-https-redirect"


      - "traefik.http.routers.vaultwarden-secure.entrypoints=https"
      - "traefik.http.routers.vaultwarden-secure.rule=Host(`vaultwarden.domain.com`)"


      - "traefik.http.routers.vaultwarden-secure.tls=true"
      - "traefik.http.routers.vaultwarden-secure.tls.certresolver=cloudflare"
      - "traefik.http.routers.vaultwarden-secure.tls.domains[0].main=domain.com"
      - "traefik.http.routers.vaultwarden-secure.tls.domains[0].sans=*.domain.com"


      - "traefik.docker.network=proxy"


    security_opt:
      - no-new-privileges:true


  traefik:
    image: traefik:latest
    container_name: traefik
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    networks:
       proxy:
          ipv4_address: 172.25.0.2
    ports:
      - "80:80"
      - "443:443"
      - "853:853"
      - "25:25"
      - "465:465"
      - "993:993"
      - "4190:4190"
    environment:
      - CF_API_EMAIL=${CF_API_EMAIL}
      #- CF_DNS_API_TOKEN=${CF_API_TOKEN}
      - CF_API_KEY=
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ${DOCKER_VOLUMES_FOLDER}/traefik/traefik.yml:/traefik.yml:ro
      - ${DOCKER_VOLUMES_FOLDER}/traefik/acme.json:/acme.json
      - ${DOCKER_VOLUMES_FOLDER}/traefik/config.yml:/config.yml:ro
      - ${DOCKER_VOLUMES_FOLDER}/traefik/logs:/var/log/traefik
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.traefik.entrypoints=http"
      - "traefik.http.routers.traefik.rule=Host(`traefik.domain.com`)"
      - "traefik.http.middlewares.traefik-auth.basicauth.users=${TRAEFIK_AUTH_STR}"
      - "traefik.http.middlewares.traefik-https-redirect.redirectscheme.scheme=https"
      - "traefik.http.middlewares.sslheader.headers.customrequestheaders.X-Forwarded-Proto=https"

      - "traefik.http.routers.traefik.middlewares=traefik-https-redirect"

      - "traefik.http.routers.traefik-secure.entrypoints=https"
      - "traefik.http.routers.traefik-secure.rule=Host(`traefik.domain.com`)"
      - "traefik.http.routers.traefik-secure.middlewares=traefik-auth"
      - "traefik.http.routers.traefik-secure.tls=true"
      - "traefik.http.routers.traefik-secure.tls.certresolver=cloudflare"
      - "traefik.http.routers.traefik-secure.tls.domains[0].main=domain.com"
      - "traefik.http.routers.traefik-secure.tls.domains[0].sans=*.domain.com"
      - "traefik.http.routers.traefik-secure.service=api@internal"