DOCKER COMPOSE FILE:
version: '3'

services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: unless-stopped
    networks:
      - proxy
    volumes:
      - /dockerconfigs/vaultwarden-config/data:/data/
    ports:
      - 8991:80
    environment:
      - LOG_LEVEL=debug
      - ADMIN_TOKEN=fakefake
    labels:
      - "com.centurylinklabs.watchtower.enable=true"
      - traefik.enable=true
      - traefik.http.routers.vaultwarden.tls=true
      - traefik.http.routers.vaultwarden.rule=Host(`vault.domain.com`)
      - traefik.http.routers.vaultwarden.entrypoints=websecure
      - traefik.http.services.vaultwarden.loadbalancer.server.port=80
      - traefik.docker.network=proxy
      - traefik.http.routers.vaultwarden.tls.certresolver=letsencrypt
      - traefik.http.routers.vaultwarden.tls.domains[0].main=*.domain.com
      - traefik.http.routers.vaultwarden.tls.domains[0].sans=domain.com
      - traefik.http.middlewares.vaultwarden.headers.SSLRedirect=true
      - traefik.http.middlewares.vaultwarden.headers.STSSeconds=315360000
      - traefik.http.middlewares.vaultwarden.headers.browserXSSFilter=true
      - traefik.http.middlewares.vaultwarden.headers.contentTypeNosniff=true
      - traefik.http.middlewares.vaultwarden.headers.forceSTSHeader=true
      - traefik.http.middlewares.vaultwarden.headers.SSLHost=
      - traefik.http.middlewares.vaultwarden.headers.STSIncludeSubdomains=true
      - traefik.http.middlewares.vaultwarden.headers.STSPreload=true
      - traefik.http.middlewares.vaultwarden.headers.frameDeny=true

networks:
  proxy:
    external: true


TRAEFIK DYNAMIC CONFIG FILE:
# Dynamic configuration
http:
  routers:
    pterodactyl:
      service: pterodactyl
      middlewares:
      rule: "Host(`panel.domain.com`)"

    vaultwarden:
      service: vaultwarden
      middlewares:
      rule: "Host(`vault.domain.com`)"

    #photoprism:
     # service: photoprism
     # middlewars:
     # rule: "Host(`jasper.domain.com`)"

    audiobookshelf:
      service: audiobookshelf
      middlewares:
      rule: "Host(`audio.domain.com`)"

    overseerr:
      service: overseerr
      middlewares:
      rule: "Host(`overseerr.domain.com`)"


  middlewares:
    secureHeaders:
      headers:
        sslRedirect: true
        forceSTSHeader: true
        stsIncludeSubdomains: true
        stsPreload: true
        stsSeconds: 31536000
    user-auth:
      basicAuth:
        users:
          - "admin:hash"

  services:

    pterodactyl:
      loadBalancer:
        servers:
          - url: "http://192.168.10.246:80"

    #photoprism:
     # loadBalancer:
     #   servers:
     #     - url: "http://192.168.10.43:2342/"

    audiobookshelf:
      loadBalancer:
        servers:
          - url: "http://192.168.10.43:13378"

    overseerr:
      loadBalancer:
        servers:
          - url: "http://192.168.10.43:5055"

    vaultwarden:
      loadBalancer:
        servers:
         - url: "https://192.168.10.43:8991"


tls:
  options:
    default:
      cipherSuites:
        - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
        - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
        - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
        - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
        - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
        - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
      minVersion: VersionTLS12