#docker-compose.yml
version: '3'

services:
  traefik:
    image: "traefik:v2.2"
    container_name: "traefik"
    command:
      - "--api.insecure=true"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoint.web.address=:80"
      - "--entrypoint.websecure.address=:443"
    ports:
      - "80:80"
      - "443:443"
      - "3012:3012"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
  bitwarden:
    depends_on:
      - db
    build:
        context: ./bitwarden_rs
        dockerfile: docker/amd64/mysql/Dockerfile
    restart: always
    volumes:
      - /work/bw-data:/data
      - /work/ssl:/ssl
      - /etc/localtime:/etc/localtime:ro
    environment:
      ROCKET_TLS: '{certs = "/ssl/*FQDN*.crt", key = "/ssl/*FQDN*.key"}'
      ROCKET_PORT: 443
      DOMAIN: 'https://*FQDN*'
      WEBSOCKET_ENABLED: 'true' # Requiered to use websockets
      SIGNUPS_ALLOWED: 'false' # set to false to disable signups
      INVITATIONS_ALLOWED: 'true'
      LOG_FILE: '/data/bitwarden.log'
      WEB_VAULT_ENABLED: 'true'
      ADMIN_TOKEN: '*ADMIN_TOKEN*'
      SMTP_HOST: '*MAILSERVER_FQDN*'
      SMTP_FROM: '*FQDN*'
      SMTP_PORT: 25
      SMTP_SSL: 'false'
      DATABASE_URL: '*DATABASE_URL*'
      ENABLE_DB_WAL: 'false'
    #ports:
      #- 443:443
      #- 80:443
    labels:
      - traefik.enable=true
      - traefik.docker.network=traefik
      - traefik.http.middlewares.redirect-https.redirectScheme.scheme=https
      - traefik.http.middlewares.redirect-https.redirectScheme.permanent=true
      - traefik.http.routers.bitwarden-ui-https.rule=Host(`*FQDN*`)
      - traefik.http.routers.bitwarden-ui-https.entrypoints=websecure
      - traefik.http.routers.bitwarden-ui-https.tls=true
      - traefik.http.routers.bitwarden-ui-https.service=bitwarden-ui
      - traefik.http.routers.bitwarden-ui-http.rule=Host(`FQDN*`)
      - traefik.http.routers.bitwarden-ui-http.entrypoints=web
      - traefik.http.routers.bitwarden-ui-http.middlewares=redirect-https
      - traefik.http.routers.bitwarden-ui-http.service=bitwarden-ui
      - traefik.http.services.bitwarden-ui.loadbalancer.server.port=80
      - traefik.http.routers.bitwarden-websocket-https.rule=Host(`FQDN*`) && Path(`/notifications/hub`)
      - traefik.http.routers.bitwarden-websocket-https.entrypoints=websecure
      - traefik.http.routers.bitwarden-websocket-https.tls=true
      - traefik.http.routers.bitwarden-websocket-https.service=bitwarden-websocket
      - traefik.http.routers.bitwarden-websocket-http.rule=Host(`FQDN*`) && Path(`/notifications/hub`)
      - traefik.http.routers.bitwarden-websocket-http.entrypoints=web
      - traefik.http.routers.bitwarden-websocket-http.middlewares=redirect-https
      - traefik.http.routers.bitwarden-websocket-http.service=bitwarden-websocket
      - traefik.http.services.bitwarden-websocket.loadbalancer.server.port=3012
  db:
    image: mariadb:10.4
    restart: always
    container_name: 'db'
    volumes:
      - /work/mysql:/var/lib/mysql
      - /etc/localtime:/etc/localtime:ro
    environment:
      MYSQL_ROOT_PASSWORD: '*MYSQL_ROOT_PASSWORD*'
      MYSQL_DATABASE: 'bitwarden'
      MYSQL_USER: 'bitwarden'
      MYSQL_PASSWORD: '*MYSQL_PASSWORD*'