services:
  homeassistant:
    # runs on 8123
    container_name: homeassistant
    privileged: true
    image: "ghcr.io/home-assistant/home-assistant:stable"
#    image: "ghcr.io/home-assistant/home-assistant:2025.11.3"
    deploy:
      resources:
        limits:
          memory: 1g
    volumes:
      - /ssd/docker/container/homeassistant:/config
      - /etc/localtime:/etc/localtime:ro
    restart: always
    #privileged: true
    network_mode: host

  trilium:
    container_name: trilium
    # runs on 8081
    # Optionally, replace `latest` with a version tag like `v0.90.3`
    # Using `latest` may cause unintended updates to the container
    image: triliumnext/trilium:latest
    deploy:
      resources:
        limits:
          memory: 512m
    # Restart the container unless it was stopped by the user
    restart: unless-stopped
    environment:
      - TRILIUM_DATA_DIR=/home/node/trilium-data
    ports:
      # By default, Trilium will be available at http://localhost:8080
      # It will also be accessible at http://<host-ip>:8080
      # You might want to limit this with something like Docker Networks, reverse proxies, or firewall rules,
      # however be aware that using UFW is known to not work with default Docker installations, see:
      # https://docs.docker.com/engine/network/packet-filtering-firewalls/#docker-and-ufw
      - '8081:8080'
    volumes:
      # Unless TRILIUM_DATA_DIR is set, the data will be stored in the "trilium-data" directory in the home directory.
      # This can also be changed with by replacing the line below with `- /path/of/your/choice:/home/node/trilium-data
      - ${TRILIUM_DATA_DIR:-/ssd/docker/container/trilium-data}:/home/node/trilium-data
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro

  vaultwarden:
    container_name: vaultwarden
    image: vaultwarden/server:latest
    deploy:
      resources:
        limits:
          memory: 256m
    restart: unless-stopped
    environment:
      - DOMAIN=https://vw.siora.de  # Your Apache-accessible URL
      - SIGNUPS_ALLOWED=true  # Disable after account creation
      - WEBSOCKET_ENABLED=true  # For real-time sync
    volumes:
      - ./vw-data:/data
    ports:
      - "8880:80"  # Bind to localhost only (secure)
#      - "127.0.0.1:8000:8880"  # Bind to localhost only (secure)
