Vaultwarden를 해외 VPS에 호스팅

# 1) DNS: vault.example.com -> ChainVPS IP로 연결 (A/AAAA 레코드)
# 2) Argon2 ADMIN_TOKEN 생성 (평문 문자열을 사용하지 마세요):
#    docker run --rm -it vaultwarden/server /vaultwarden hash
#    결과로 나온 '$argon2id$...' 문자열을 아래 ADMIN_TOKEN에 붙여넣으세요 (.env에서는 작은따옴표로 감싸기)
# 3) docker-compose.yml로 저장하고, 아래 Caddyfile을 만든 뒤: docker compose up -d

services:
  vaultwarden:
    image: vaultwarden/server:1.32.7
    container_name: vaultwarden
    restart: unless-stopped
    environment:
      DOMAIN: "https://vault.example.com"      # must match the public URL exactly
      SIGNUPS_ALLOWED: "false"                  # create your account, then keep this false
      INVITATIONS_ALLOWED: "true"
      ADMIN_TOKEN: "${ADMIN_TOKEN}"             # Argon2 hash from step 2, kept in .env
      WEBSOCKET_ENABLED: "true"                 # live sync (served on the main port)
      SENDS_ALLOWED: "true"
      ROCKET_PORT: "80"
    volumes:
      - ./vw-data:/data                         # vaults, attachments, sqlite db, keys
    networks: [vw]
    # no host port published: only Caddy talks to it over the internal network

  caddy:
    image: caddy:2
    container_name: vaultwarden-caddy
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
      - "443:443/udp"                           # HTTP/3
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - ./caddy-data:/data
      - ./caddy-config:/config
    networks: [vw]
    depends_on: [vaultwarden]

networks:
  vw:

# ---- Caddyfile (같은 디렉터리) ----
# vault.example.com {
#     encode gzip
#     reverse_proxy vaultwarden:80
# }
# Caddy는 Let's Encrypt 인증서를 자동으로 발급하고 갱신합니다. Bitwarden 클라이언트는
# WebCrypto를 사용하며, 이는 보안 origin에서만 동작하므로 HTTPS는 필수입니다.