# Vaultwarden — Self-hosted Bitwarden server
#
# Runs inside the LUKS-encrypted container at /mnt/rook-vault/vaultwarden/
# Only accessible from localhost (no external exposure).
#
# Start: docker compose -f docker-compose.vaultwarden.yml up -d
# Stop:  docker compose -f docker-compose.vaultwarden.yml down
#
# Prerequisites:
#   - LUKS container must be open and mounted at /mnt/rook-vault/
#   - Docker installed

services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: rook-vaultwarden
    restart: unless-stopped

    # Only accessible from localhost — never exposed to network
    ports:
      - "127.0.0.1:8200:80"

    # Data lives inside LUKS container
    volumes:
      - /mnt/rook-vault/vaultwarden/data:/data

    environment:
      # Disable signups after initial setup
      - SIGNUPS_ALLOWED=false
      # Disable invitations
      - INVITATIONS_ALLOWED=false
      # Admin token (set during first-boot, stored in vault itself after)
      - ADMIN_TOKEN=${VAULTWARDEN_ADMIN_TOKEN:-}
      # Disable web vault UI (we use CLI only)
      - WEB_VAULT_ENABLED=false
      # Log level
      - LOG_LEVEL=warn
      # Rocket config
      - ROCKET_PORT=80
      - ROCKET_ADDRESS=0.0.0.0

    # Resource limits (Jetson-friendly)
    mem_limit: 256m
    cpus: 1.0

    healthcheck:
      test: ["CMD", "curl", "-sf", "http://localhost:80/alive"]
      interval: 30s
      timeout: 5s
      retries: 3
