# /opt/stacks/vaultwarden/docker-compose.yml

services:

  vaultwarden:
    container_name: vaultwarden
    image: vaultwarden/server:latest
    restart: unless-stopped
    environment:
      TZ: Europe/Madrid
      # Domini públic (obligatori per a links d'invitació i 2FA)
      DOMAIN: 'https://vault.el-meu-domini.com'
      # Seguretat: registre tancat
      SIGNUPS_ALLOWED: "false"
      # Token admin — usa hash argon2id (vegeu .env i instruccions sota)
      ADMIN_TOKEN: '${VAULTWARDEN_ADMIN_TOKEN}'
      # Configuració SMTP
      SMTP_HOST: '${SMTP_HOST}'
      SMTP_PORT: 587
      SMTP_SECURITY: starttls              # Explícit: starttls | force_tls | off
      SMTP_FROM: '${SMTP_FROM}'
      SMTP_USERNAME: '${SMTP_USERNAME}'
      SMTP_PASSWORD: '${SMTP_PASSWORD}'
      SMTP_FROM_NAME: Vaultwarden
      # Logs
      LOG_LEVEL: warn
      # WebSockets integrats al port principal des de v1.29.0
      # WEBSOCKET_ENABLED i port 3012 eliminats des de v1.31.0
    volumes:
      - vaultwarden_data:/data
    ports:
      - "127.0.0.1:8080:80"               # Port únic — WebSockets inclosos
      # Port 3012 ELIMINAT — ja no existeix des de v1.31.0
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:80/alive"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 15s
    networks:
      - shared_net

volumes:
  vaultwarden_data:

networks:
  shared_net:
    external: true
    name: shared_net