# Furtka Vaultwarden — Bitwarden-compatible password manager.
#
# One Docker-managed volume (data) holds the SQLite vault, attachments and
# the RSA keys. The volume `furtka_vaultwarden_data` is created by the Furtka
# reconciler from the manifest's "volumes" list before compose comes up;
# `external: true` keeps compose from managing its lifecycle.
#
# HTTPS: the Bitwarden web vault and clients need a secure context, so plain
# http://<host>:8222 only shows a warning page. Reach it through Furtka
# Gateway (manifest `internet.viable`) or the box's local HTTPS.
#
# No ADMIN_TOKEN: the /admin panel stays disabled. Account creation is
# controlled by SIGNUPS_ALLOWED from the install form; the user turns it off
# after creating their accounts.
#
# Image pin: 1.37.4 (multi-arch, x86_64 + arm64). Bump deliberately.

services:
  vaultwarden:
    image: vaultwarden/server:1.37.4
    restart: unless-stopped
    ports:
      - "8222:80"
    environment:
      - TZ=Europe/Berlin
      - SIGNUPS_ALLOWED=${SIGNUPS_ALLOWED:-true}
    volumes:
      - furtka_vaultwarden_data:/data

volumes:
  furtka_vaultwarden_data:
    external: true