version: '3.8'

services:
  vaultwarden-api:
    build:
      context: .
      dockerfile: Dockerfile
    container_name: vaultwarden-api
    restart: unless-stopped
    ports:
      - "8080:8080"
    environment:
      # Server configuration
      - API_PORT=8080
      - ENVIRONMENT=production

      # Security - REQUIRED
      # IMPORTANT: Change these values before deploying!
      - API_KEY=${API_KEY}

      # Vaultwarden configuration
      - VAULTWARDEN_URL=${VAULTWARDEN_URL}
      - VAULTWARDEN_ACCESS_TOKEN=${VAULTWARDEN_ACCESS_TOKEN}

      # Performance
      - CACHE_TTL=5m
      - READ_TIMEOUT=10s
      - WRITE_TIMEOUT=10s

    # Security: read-only filesystem (except for tmp)
    read_only: true
    tmpfs:
      - /tmp

    # Security: drop all capabilities
    cap_drop:
      - ALL

    # Security: prevent privilege escalation
    security_opt:
      - no-new-privileges:true

    # Resource limits (adjust based on your needs)
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 128M
        reservations:
          cpus: '0.25'
          memory: 64M

    # Health check
    healthcheck:
      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:8080/health"]
      interval: 30s
      timeout: 3s
      retries: 3
      start_period: 5s

    # Logging configuration
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"

    # Network configuration
    networks:
      - vaultwarden-network

networks:
  vaultwarden-network:
    driver: bridge

# For production deployment with Portainer Stack:
# 1. Copy this file to your Portainer environment
# 2. Set environment variables in Portainer's stack configuration
# 3. Or create a .env file (but NEVER commit it to git!)
# 4. Deploy behind a reverse proxy (Nginx Proxy Manager, Traefik, etc.)
# 5. Ensure HTTPS is enabled on the reverse proxy