8aecc5005a
- Ajouter les capabilities Linux (cap_drop/cap_add) pour limiter les privilèges - Configurer les limites de ressources (256M RAM, 0.5 CPU) - Ajouter un healthcheck pour surveiller l'état du service - Configurer les variables SMTP pour la récupération de mot de passe - Documenter .env.example avec des exemples et instructions 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
64 lines
1.7 KiB
YAML
64 lines
1.7 KiB
YAML
services:
|
|
vaultwarden:
|
|
image: vaultwarden/server:latest
|
|
container_name: vaultwarden
|
|
restart: unless-stopped
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
cap_drop:
|
|
- ALL
|
|
cap_add:
|
|
- CHOWN
|
|
- SETGID
|
|
- SETUID
|
|
read_only: false
|
|
environment:
|
|
- DOMAIN=${DOMAIN}
|
|
- SIGNUPS_ALLOWED=false
|
|
- ADMIN_TOKEN=${ADMIN_TOKEN}
|
|
- WEBSOCKET_ENABLED=true
|
|
# Limite de tentatives de connexion
|
|
- LOGIN_RATELIMIT_MAX_BURST=10
|
|
- LOGIN_RATELIMIT_SECONDS=60
|
|
# Limite d'envoi d'emails (récupération mot de passe)
|
|
- EMAIL_ATTEMPTS_LIMIT=3
|
|
- EMAIL_EXPIRATION_TIME=600
|
|
# Timeout de session
|
|
- EXTENDED_LOGGING=true
|
|
|
|
# Notifications
|
|
- SENDS_ALLOWED=true
|
|
# - EMERGENCY_ACCESS_ALLOWED=true
|
|
#
|
|
- SMTP_HOST=${SMTP_HOST}
|
|
- SMTP_PORT=${SMTP_PORT}
|
|
- SMTP_FROM=${SMTP_FROM}
|
|
- SMTP_USERNAME=${SMTP_USER}
|
|
- SMTP_PASSWORD=${SMTP_PASSWORD}
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.http.routers.vaultwarden.rule=Host(`${DOMAIN}`)"
|
|
- "traefik.http.routers.vaultwarden.entrypoints=websecure"
|
|
- "traefik.http.routers.vaultwarden.tls=true"
|
|
- "traefik.http.routers.vaultwarden.tls.certresolver=letsencrypt"
|
|
- "traefik.http.services.vaultwarden.loadbalancer.server.port=80"
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
memory: 256M
|
|
cpus: "0.5"
|
|
reservations:
|
|
memory: 128M
|
|
healthcheck:
|
|
test: ["CMD", "curl", "-f", "http://localhost:80/alive"]
|
|
interval: 30s
|
|
timeout: 3s
|
|
retries: 3
|
|
volumes:
|
|
- ./data:/data
|
|
networks:
|
|
- traefik-net
|
|
networks:
|
|
traefik-net:
|
|
external: true
|