services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    networks:
      - pangolin
    environment:
      DOMAIN: "https://${DOMAIN}"
      ADMIN_TOKEN: ${VAULTWARDEN_ADMIN_TOKEN}
    volumes:
      - /mnt/user/appdata/vaultwarden/data:/data/
    labels:
      net.unraid.docker.icon: "https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/bitwarden.png"
      net.unraid.docker.webui: "https://${DOMAIN}"
      folder.view3: "Services"

      pangolin.public-resources.vaultwarden-server.name: "${RESOURCE_NAME}"
      pangolin.public-resources.vaultwarden-server.full-domain: "${DOMAIN}"
      pangolin.public-resources.vaultwarden-server.protocol: "http"

      pangolin.public-resources.vaultwarden-server.auth.sso-enabled: true
      pangolin.public-resources.vaultwarden-server.auth.sso-roles[0]: "Member"

      pangolin.public-resources.vaultwarden-server.targets[0].method: "http"

      pangolin.public-resources.vaultwarden-server.targets[0].healthcheck.enabled: true
      pangolin.public-resources.vaultwarden-server.targets[0].healthcheck.hostname: "vaultwarden"
      pangolin.public-resources.vaultwarden-server.targets[0].healthcheck.port: 80
      pangolin.public-resources.vaultwarden-server.targets[0].healthcheck.path: "/api/alive"
      pangolin.public-resources.vaultwarden-server.targets[0].healthcheck.method: "GET"
      pangolin.public-resources.vaultwarden-server.targets[0].healthcheck.status: 200
      pangolin.public-resources.vaultwarden-server.targets[0].healthcheck.interval: 30
      pangolin.public-resources.vaultwarden-server.targets[0].healthcheck.timeout: 5

      pangolin.public-resources.vaultwarden-server.rules[0].action: "allow"
      pangolin.public-resources.vaultwarden-server.rules[0].match: "path"
      pangolin.public-resources.vaultwarden-server.rules[0].value: "/api/*"
      pangolin.public-resources.vaultwarden-server.rules[1].action: "allow"
      pangolin.public-resources.vaultwarden-server.rules[1].match: "path"
      pangolin.public-resources.vaultwarden-server.rules[1].value: "/identity/*"
      pangolin.public-resources.vaultwarden-server.rules[2].action: "allow"
      pangolin.public-resources.vaultwarden-server.rules[2].match: "path"
      pangolin.public-resources.vaultwarden-server.rules[2].value: "/wl/*"
      pangolin.public-resources.vaultwarden-server.rules[3].action: "deny"
      pangolin.public-resources.vaultwarden-server.rules[3].match: "path"
      pangolin.public-resources.vaultwarden-server.rules[3].value: "/admin/*"

      # HOMEPAGE
      homepage.group: Security
      homepage.name: "${RESOURCE_NAME}"
      homepage.icon: vaultwarden.png
      homepage.href: "https://${DOMAIN}"
      homepage.description: Password Manager

networks:
  pangolin:
    name: pangolin_net
    external: true