services:
  vaultwarden:
    image: vaultwarden/server:1.37.2
    container_name: vaultwarden
    restart: unless-stopped
    env_file: ".env"
    environment:
      DOMAIN: "https://auth.wsvc.info"
      DATABASE_URL: "postgresql://${DB_USER}:${DB_PASS}@${DB_HOST}:${DB_PORT}/${DB_NAME}"
    volumes:
      - ./vw-data:/data
    extra_hosts:
      - "mx2.windy.me:194.163.160.244"
    networks:
      - net
    depends_on:
      pg:
        condition: service_healthy
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=vw-net"

      - "traefik.http.routers.vaultwarden.rule=Host(`auth.wsvc.info`)"
      - "traefik.http.routers.vaultwarden.entrypoints=websecure"
      - "traefik.http.routers.vaultwarden.tls=true"
      - "traefik.http.routers.vaultwarden.tls.certresolver=letsencrypt"

      - "traefik.http.services.vaultwarden.loadbalancer.server.port=80"

  backup:
    build:
      context: .
      dockerfile: Dockerfile.backup
    container_name: vaultwarden-backup
    restart: unless-stopped
    volumes:
      - ./backups:/backup
      - ./scripts:/scripts
    #user: "${UID:-1000}:${GID:-1000}"
    
    environment:
      DB_HOST: ${DB_HOST}
      DB_PORT: ${DB_PORT}
      DB_USER: ${DB_USER}
      DB_NAME: ${DB_NAME}
      DB_PASS: ${DB_PASS}
      BACKUP_UID: ${UID:-0}
      BACKUP_GID: ${GID:-0}
      TZ: Asia/Shanghai
    entrypoint: >
      /bin/sh -ec "
        umask 077 &&
        printf '%s:%s:*:%s:%s\n' \"$$DB_HOST\" \"$$DB_PORT\" \"$$DB_USER\" \"$$DB_PASS\" > /root/.pgpass &&
        chmod 600 /root/.pgpass &&
        touch /backup/backup.log &&
        crontab /scripts/crontab.txt &&
        echo '[INFO] Backup cron installed' &&
        echo '[INFO] Starting crond...' &&
        crond -f -l 8
      "
    networks: [net]

  pg:
    image: postgres:16
    container_name: vw-db
    restart: unless-stopped
    environment:
      POSTGRES_DB: ${DB_NAME}
      POSTGRES_USER: ${DB_USER}
      POSTGRES_PASSWORD: ${DB_PASS}
      TZ: Asia/Shanghai
      PGTZ: Asia/Shanghai
    volumes:
      - vwdata:/var/lib/postgresql/data
      - ./backups:/backup           # to import existing dump
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${DB_USER} -d ${DB_NAME}"]
      interval: 10s
      timeout: 5s
      retries: 10
    networks: [net]

  pgweb:
    profiles: ["debug"]
    image: sosedoff/pgweb:0.16.2
    container_name: vaultwarden-pgweb
    restart: unless-stopped
    environment:
      # 用 Vaultwarden 的数据库参数拼接连接串
      #DATABASE_URL: "postgres://${DB_USER}:${DB_PASS}@${DB_HOST}:${DB_PORT}/${DB_NAME}?sslmode=disable"
      PGWEB_AUTH_USER: ${PGWEB_USER}
      PGWEB_AUTH_PASS: ${PGWEB_PASS}
      TZ: Asia/Shanghai
    #ports:
    #  - "8082:8081"     # 本地访问 http://localhost:8082
    depends_on:
      pg:
        condition: service_healthy
    networks: [net]

networks:
  net:
    name: vw-net
    external: true

volumes:
  vwdata: {}