feat: add vaultwarden deployment config (compose + k8s)

vaultwarden/.env.example

@@ -0,0 +1 @@
+DOMAIN=vw.parrot.internal

vaultwarden/compose.yaml

@@ -0,0 +1,34 @@
+services:
+  server:
+    container_name: vaultwarden-server
+    image: vaultwarden/server:latest
+    restart: unless-stopped
+    ports:
+      - 9993:80
+    environment:
+      - DOMAIN=${DOMAIN:-http://localhost}
+    volumes:
+      - "data:/data/"
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.services.vaultwarden.loadbalancer.server.port=80"
+
+      # Prod Router
+      - "traefik.http.routers.vaultwarden.rule=Host(`vw.forust.xyz`)"
+      - "traefik.http.routers.vaultwarden.entrypoints=websecure"
+      - "traefik.http.routers.vaultwarden.tls.certresolver=letsencrypt"
+      # Local Router
+      - "traefik.http.routers.vaultwarden-local.rule=Host(`vw.workstation.internal`)"
+      - "traefik.http.routers.vaultwarden-local.entrypoints=websecure"
+      - "traefik.http.routers.vaultwarden.tls=true"
+      # Dev Router
+      - "traefik.http.routers.vaultwarden-dev.rule=Host(`vw.gigaforust.internal`)"
+      - "traefik.http.routers.vaultwarden-dev.entrypoints=websecure"
+      - "traefik.http.routers.vaultwarden-dev.tls=true"
+    networks:
+      - proxy
+volumes:
+  data:
+networks:
+  proxy:
+    external: true

vaultwarden/k8s/config.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: vaultwarden-config
+  namespace: vaultwarden
+data:
+  DOMAIN: "https://vw.forust.xyz"

vaultwarden/k8s/ingress.yaml

@@ -0,0 +1,27 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: vaultwarden-prod
+  namespace: vaultwarden
+spec:
+  routes:
+    - match: Host(`vw.forust.xyz`)
+      kind: Rule
+      services:
+        - name: vaultwarden-service
+          port: 80
+  tls:
+    certResolver: letsencrypt
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: vaultwarden-local
+  namespace: vaultwarden
+spec:
+  routes:
+    - match: Host(`vw.workstation.internal`) || Host(`vw.gigaforust.internal`)
+      kind: Rule
+      services:
+        - name: vaultwarden-service
+          port: 80

vaultwarden/k8s/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: vaultwarden

vaultwarden/k8s/vaultwarden.yaml

@@ -0,0 +1,61 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: vaultwarden-service
+  namespace: vaultwarden
+spec:
+  selector:
+    app: vaultwarden
+  ports:
+    - port: 80
+      targetPort: 80
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: vaultwarden-deployment
+  namespace: vaultwarden
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: vaultwarden
+  template:
+    metadata:
+      labels:
+        app: vaultwarden
+    spec:
+      containers:
+        - name: vaultwarden
+          image: vaultwarden/server:latest
+          ports:
+            - containerPort: 80
+          envFrom:
+            - configMapRef:
+                name: vaultwarden-config
+          resources:
+            requests:
+              cpu: "100m"
+              memory: "128Mi"
+            limits:
+              cpu: "500m"
+              memory: "512Mi"
+          volumeMounts:
+            - name: vaultwarden-data
+              mountPath: /data
+      volumes:
+        - name: vaultwarden-data
+          persistentVolumeClaim:
+            claimName: vaultwarden-pvc
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: vaultwarden-pvc
+  namespace: vaultwarden
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi