---
version: "3.8"

services:
  app:
    environment:
    # DATABASE_URL with secret db_password is being set by entrypoint.sh.tmpl
    - MYSQL_HOST=db
    - MYSQL_DATABASE=vaultwarden
    - MYSQL_USER=vaultwarden
    - MYSQL_PASSWORD_FILE=/run/secrets/db_password
    secrets:
      - db_password

  db:
    image: "mariadb:10.6" # or "mysql"
    environment:
      - MYSQL_DATABASE=vaultwarden
      - MYSQL_USER=vaultwarden
      - MYSQL_PASSWORD_FILE=/run/secrets/db_password
      - MYSQL_ROOT_PASSWORD_FILE=/run/secrets/db_root_password
      - MAX_DB_CONNECTIONS=${MAX_DB_CONNECTIONS:-100}#
    secrets:
      - db_root_password
      - db_password
    volumes:
      - "mariadb:/var/lib/mysql"
    networks:
      - internal
    deploy:
      labels:
        backupbot.backup.pre-hook: 'mysqldump --single-transaction -u root -p"$$(cat /run/secrets/db_root_password)" $${MYSQL_DATABASE} > /var/lib/mysql/backup.sql'
        backupbot.backup.volumes.mariadb.path: "backup.sql"
        backupbot.restore.post-hook: 'mysql -u root -p"$$(cat /run/secrets/db_root_password)" $${MYSQL_DATABASE} < /var/lib/mysql/backup.sql'
    healthcheck:
      test: ["CMD-SHELL", 'mysqladmin -p"$$(cat /run/secrets/db_root_password)"  ping']
      interval: 5s
      timeout: 10s
      retries: 0
      start_period: 1m

secrets:
  db_root_password:
    external: true
    name: ${STACK_NAME}_db_root_password_${SECRET_DB_ROOT_PASSWORD_VERSION}
  db_password:
    external: true
    name: ${STACK_NAME}_db_password_${SECRET_DB_PASSWORD_VERSION}

volumes:
  mariadb: