Host Vaultwarden on an Offshore VPS

# 1) DNS: point vault.example.com -> your ChainVPS IP (A/AAAA record)
# 2) Generate an Argon2 ADMIN_TOKEN (do NOT use a plain string):
#    docker run --rm -it vaultwarden/server /vaultwarden hash
#    paste the resulting '$argon2id$...' string as ADMIN_TOKEN below (single-quote it in .env)
# 3) Save as docker-compose.yml, create the Caddyfile shown, then: docker compose up -d

services:
  vaultwarden:
    image: vaultwarden/server:1.32.7
    container_name: vaultwarden
    restart: unless-stopped
    environment:
      DOMAIN: "https://vault.example.com"      # must match the public URL exactly
      SIGNUPS_ALLOWED: "false"                  # create your account, then keep this false
      INVITATIONS_ALLOWED: "true"
      ADMIN_TOKEN: "${ADMIN_TOKEN}"             # Argon2 hash from step 2, kept in .env
      WEBSOCKET_ENABLED: "true"                 # live sync (served on the main port)
      SENDS_ALLOWED: "true"
      ROCKET_PORT: "80"
    volumes:
      - ./vw-data:/data                         # vaults, attachments, sqlite db, keys
    networks: [vw]
    # no host port published: only Caddy talks to it over the internal network

  caddy:
    image: caddy:2
    container_name: vaultwarden-caddy
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
      - "443:443/udp"                           # HTTP/3
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - ./caddy-data:/data
      - ./caddy-config:/config
    networks: [vw]
    depends_on: [vaultwarden]

networks:
  vw:

# ---- Caddyfile (same directory) ----
# vault.example.com {
#     encode gzip
#     reverse_proxy vaultwarden:80
# }
# Caddy fetches and renews a Let's Encrypt cert automatically; HTTPS is mandatory
# because Bitwarden clients use WebCrypto, which only runs on a secure origin.