version: '3.8'

# Deploy with:
#   docker stack deploy -c vaultwarden.yml vaultwarden
#
# Runs on: pve-tools
# Self-hosted Bitwarden-compatible password manager.
# Uses default SQLite backend; data persisted in a named volume.
# Web vault exposed on port 8222.

services:
  vaultwarden:
    image: vaultwarden/server:latest
    environment:
      SIGNUPS_ALLOWED: "false"
      INVITATIONS_ALLOWED: "true"
      SHOW_PASSWORD_HINT: "false"
      ROCKET_PORT: 8222
      ADMIN_TOKEN: ${VAULT_ADMIN_TOKEN}
    ports:
      - "8222:8222"
    volumes:
      - vaultwarden_data:/data

volumes:
  vaultwarden_data: