vaultwarden traefik 2.8 digital ocean dns validation

docker-compose.yaml

version: '3'

services:
  vaultwarden:
    image: vaultwarden/server:1.25.1-arm32v6
    #image: vaultwarden/server:1.24.0-arm32v6
    container_name: vaultwarden
    restart: always
    network_mode: host
    environment:
      - WEBSOCKET_ENABLED=true # Enable WebSocket notifications.
      - ADMIN_TOKEN=XXX
      - SIGNUPS_ALLOWED=true
        #- DOMAIN=https://{{DOMAIN}}
      # - SIGNUPS_ALLOWED=true
      # - SIGNUPS_VERIFY=true
      - SIGNUPS_DOMAINS_WHITELIST=tld.de
    volumes:
      - ./data:/data
    environment:
      - ROCKET_PORT=8080
    labels:
      - traefik.enable=true
      - traefik.http.services.pass.loadbalancer.server.port=8080
      - traefik.http.routers.pass.rule=Host(`pass.xxx.tld`)
      - traefik.http.routers.pass.tls.certresolver=le
      - traefik.http.routers.pass.entrypoints=websecure
  traefik:
    network_mode: host
    image: traefik:v2.8.1
    container_name: traefik
    restart: always
    command:
      - --api=true
      - --api.dashboard=false
      - --log.level=info
      - --entrypoints.web.address=:80
      - --entrypoints.web.http.redirections.entryPoint.to=websecure
      - --entrypoints.websecure.address=:443
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
      - --certificatesresolvers.le.acme.dnschallenge=true
      - --certificatesresolvers.le.acme.dnschallenge.provider=digitalocean
      - --certificatesresolvers.le.acme.dnschallenge.delaybeforecheck=0
      - --certificatesresolvers.le.acme.email=XXX
      - --certificatesresolvers.le.acme.storage=/shared/acme.json
    environment:
      - DO_AUTH_TOKEN=XXX
    ports:
      - 80:80
      - 443:443
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /home/pi/vaultwarden/traefik/:/shared/