From c855764bc65828702d20071ac6131ab92254d0d6 Mon Sep 17 00:00:00 2001
From: mr-forust <vzlomdsisma@gmail.com>
Date: Sun, 21 Jun 2026 01:02:09 +0200
Subject: [PATCH] feat: add vaultwarden deployment config (compose + k8s)

---
 vaultwarden/.env.example         |  1 +
 vaultwarden/compose.yaml         | 34 ++++++++++++++++++
 vaultwarden/k8s/config.yaml      |  7 ++++
 vaultwarden/k8s/ingress.yaml     | 27 ++++++++++++++
 vaultwarden/k8s/namespace.yaml   |  4 +++
 vaultwarden/k8s/vaultwarden.yaml | 61 ++++++++++++++++++++++++++++++++
 6 files changed, 134 insertions(+)
 create mode 100644 vaultwarden/.env.example
 create mode 100644 vaultwarden/compose.yaml
 create mode 100644 vaultwarden/k8s/config.yaml
 create mode 100644 vaultwarden/k8s/ingress.yaml
 create mode 100644 vaultwarden/k8s/namespace.yaml
 create mode 100644 vaultwarden/k8s/vaultwarden.yaml

diff --git a/vaultwarden/.env.example b/vaultwarden/.env.example
new file mode 100644
index 0000000..e344b7f
--- /dev/null
+++ b/vaultwarden/.env.example
@@ -0,0 +1 @@
+DOMAIN=vw.parrot.internal
diff --git a/vaultwarden/compose.yaml b/vaultwarden/compose.yaml
new file mode 100644
index 0000000..946041a
--- /dev/null
+++ b/vaultwarden/compose.yaml
@@ -0,0 +1,34 @@
+services:
+  server:
+    container_name: vaultwarden-server
+    image: vaultwarden/server:latest
+    restart: unless-stopped
+    ports:
+      - 9993:80
+    environment:
+      - DOMAIN=${DOMAIN:-http://localhost}
+    volumes:
+      - "data:/data/"
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.services.vaultwarden.loadbalancer.server.port=80"
+
+      # Prod Router
+      - "traefik.http.routers.vaultwarden.rule=Host(`vw.forust.xyz`)"
+      - "traefik.http.routers.vaultwarden.entrypoints=websecure"
+      - "traefik.http.routers.vaultwarden.tls.certresolver=letsencrypt"
+      # Local Router
+      - "traefik.http.routers.vaultwarden-local.rule=Host(`vw.workstation.internal`)"
+      - "traefik.http.routers.vaultwarden-local.entrypoints=websecure"
+      - "traefik.http.routers.vaultwarden.tls=true"
+      # Dev Router
+      - "traefik.http.routers.vaultwarden-dev.rule=Host(`vw.gigaforust.internal`)"
+      - "traefik.http.routers.vaultwarden-dev.entrypoints=websecure"
+      - "traefik.http.routers.vaultwarden-dev.tls=true"
+    networks:
+      - proxy
+volumes:
+  data:
+networks:
+  proxy:
+    external: true
diff --git a/vaultwarden/k8s/config.yaml b/vaultwarden/k8s/config.yaml
new file mode 100644
index 0000000..94e50c2
--- /dev/null
+++ b/vaultwarden/k8s/config.yaml
@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: vaultwarden-config
+  namespace: vaultwarden
+data:
+  DOMAIN: "https://vw.forust.xyz"
diff --git a/vaultwarden/k8s/ingress.yaml b/vaultwarden/k8s/ingress.yaml
new file mode 100644
index 0000000..c6284e6
--- /dev/null
+++ b/vaultwarden/k8s/ingress.yaml
@@ -0,0 +1,27 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: vaultwarden-prod
+  namespace: vaultwarden
+spec:
+  routes:
+    - match: Host(`vw.forust.xyz`)
+      kind: Rule
+      services:
+        - name: vaultwarden-service
+          port: 80
+  tls:
+    certResolver: letsencrypt
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: vaultwarden-local
+  namespace: vaultwarden
+spec:
+  routes:
+    - match: Host(`vw.workstation.internal`) || Host(`vw.gigaforust.internal`)
+      kind: Rule
+      services:
+        - name: vaultwarden-service
+          port: 80
diff --git a/vaultwarden/k8s/namespace.yaml b/vaultwarden/k8s/namespace.yaml
new file mode 100644
index 0000000..6fc17a5
--- /dev/null
+++ b/vaultwarden/k8s/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: vaultwarden
diff --git a/vaultwarden/k8s/vaultwarden.yaml b/vaultwarden/k8s/vaultwarden.yaml
new file mode 100644
index 0000000..17e4ae9
--- /dev/null
+++ b/vaultwarden/k8s/vaultwarden.yaml
@@ -0,0 +1,61 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: vaultwarden-service
+  namespace: vaultwarden
+spec:
+  selector:
+    app: vaultwarden
+  ports:
+    - port: 80
+      targetPort: 80
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: vaultwarden-deployment
+  namespace: vaultwarden
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: vaultwarden
+  template:
+    metadata:
+      labels:
+        app: vaultwarden
+    spec:
+      containers:
+        - name: vaultwarden
+          image: vaultwarden/server:latest
+          ports:
+            - containerPort: 80
+          envFrom:
+            - configMapRef:
+                name: vaultwarden-config
+          resources:
+            requests:
+              cpu: "100m"
+              memory: "128Mi"
+            limits:
+              cpu: "500m"
+              memory: "512Mi"
+          volumeMounts:
+            - name: vaultwarden-data
+              mountPath: /data
+      volumes:
+        - name: vaultwarden-data
+          persistentVolumeClaim:
+            claimName: vaultwarden-pvc
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: vaultwarden-pvc
+  namespace: vaultwarden
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi