From 0a8ab347b878ce65ec765e3a3453b495e35de064 Mon Sep 17 00:00:00 2001 From: Marcus Noble Date: Mon, 21 Sep 2026 20:16:15 +0100 Subject: [PATCH] Added vaultwarden Signed-off-by: Marcus Noble --- manifests/_apps/vaultwarden.yaml | 25 ++++++++ manifests/vaultwarden/README.md | 5 ++ manifests/vaultwarden/config.yaml | 51 ++++++++++++++++ manifests/vaultwarden/deployment.yaml | 84 +++++++++++++++++++++++++++ manifests/vaultwarden/ingres.yaml | 37 ++++++++++++ manifests/vaultwarden/pv.yaml | 29 +++++++++ manifests/vaultwarden/service.yaml | 16 +++++ 7 files changed, 247 insertions(+) create mode 100644 manifests/_apps/vaultwarden.yaml create mode 100644 manifests/vaultwarden/README.md create mode 100644 manifests/vaultwarden/config.yaml create mode 100644 manifests/vaultwarden/deployment.yaml create mode 100644 manifests/vaultwarden/ingres.yaml create mode 100644 manifests/vaultwarden/pv.yaml create mode 100644 manifests/vaultwarden/service.yaml diff --git a/manifests/_apps/vaultwarden.yaml b/manifests/_apps/vaultwarden.yaml new file mode 100644 index 0000000..7f45cc2 --- /dev/null +++ b/manifests/_apps/vaultwarden.yaml @@ -0,0 +1,25 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: vaultwarden + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: cluster.fun + destination: + namespace: vaultwarden + name: cluster-fun (v2) + source: + path: manifests/vaultwarden + repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git" + targetRevision: HEAD + syncPolicy: + automated: {} + syncOptions: + - CreateNamespace=true + ignoreDifferences: + - kind: Secret + jsonPointers: + - /data + diff --git a/manifests/vaultwarden/README.md b/manifests/vaultwarden/README.md new file mode 100644 index 0000000..8c13adb --- /dev/null +++ b/manifests/vaultwarden/README.md @@ -0,0 +1,5 @@ +# vaultwarden + +Note: There's a catch-22 when deploying this in that the Secrets can't be pulled from Vaultwarden as that are needed _for_ Vaultwarden. These need to be manually populated for this to work. + +During migration, secrets are still pulled from 1Password. diff --git a/manifests/vaultwarden/config.yaml b/manifests/vaultwarden/config.yaml new file mode 100644 index 0000000..5bf8992 --- /dev/null +++ b/manifests/vaultwarden/config.yaml @@ -0,0 +1,51 @@ +apiVersion: v1 +kind: Secret +metadata: + name: vaultwarden-credentials + labels: + app: vaultwarden + app.kubernetes.io/name: vaultwarden + annotations: + kube-1password: e75k7oktk43v4mmvbs24vyelwy + kube-1password/vault: Kubernetes + kube-1password/secret-text-parse: "true" +type: Opaque + +--- + +apiVersion: v1 +kind: Secret +metadata: + name: vaultwarden-smtp + labels: + app: vaultwarden + app.kubernetes.io/name: vaultwarden + annotations: + kube-1password: 3kiighdh7la4wdfiv5fzgm34yu + kube-1password/vault: Kubernetes + kube-1password/secret-text-parse: "true" +type: Opaque + +--- + +apiVersion: v1 +kind: ConfigMap +metadata: + name: vaultwarden-config + labels: + app: vaultwarden + app.kubernetes.io/name: vaultwarden +data: + DOMAIN: "https://vault.cluster.fun" + + # Signup Controls + SIGNUPS_ALLOWED: "false" + INVITATIONS_ALLOWED: "true" + INVITATION_ORG_NAME: "Noble" + + # Security + SHOW_PASSWORD_HINT: "false" + EXTENDED_LOGGING: "true" + LOG_LEVEL: "info" + REQUIRE_DEVICE_EMAIL: "true" + diff --git a/manifests/vaultwarden/deployment.yaml b/manifests/vaultwarden/deployment.yaml new file mode 100644 index 0000000..f05060a --- /dev/null +++ b/manifests/vaultwarden/deployment.yaml @@ -0,0 +1,84 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: vaultwarden + labels: + app: vaultwarden + app.kubernetes.io/name: vaultwarden +spec: + replicas: 2 + selector: + matchLabels: + app: vaultwarden + strategy: + type: RollingUpdate + template: + metadata: + labels: + app: vaultwarden + app.kubernetes.io/name: vaultwarden + spec: + affinity: + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - weight: 100 + podAffinityTerm: + labelSelector: + matchExpressions: + - key: app.kubernetes.io/name + operator: In + values: + - vaultwarden + topologyKey: kubernetes.io/hostname + securityContext: + runAsNonRoot: true + runAsUser: 1000 + runAsGroup: 1000 + fsGroup: 1000 + seccompProfile: + type: RuntimeDefault + containers: + - name: vaultwarden + image: vaultwarden/server:1.37.3-alpine + imagePullPolicy: IfNotPresent + ports: + - name: http + containerPort: 8080 + protocol: TCP + envFrom: + - configMapRef: + name: vaultwarden-config + - secretRef: + name: vaultwarden-credentials + - secretRef: + name: vaultwarden-smtp + volumeMounts: + - name: vaultwarden-data + mountPath: /data + - name: vaultwarden-attachments + mountPath: /data/attachments + resources: + requests: + cpu: "100m" + memory: "128Mi" + livenessProbe: + httpGet: + path: /alive + port: http + initialDelaySeconds: 30 + periodSeconds: 30 + failureThreshold: 3 + readinessProbe: + httpGet: + path: /alive + port: http + initialDelaySeconds: 30 + periodSeconds: 30 + failureThreshold: 3 + volumes: + - name: vaultwarden-data + persistentVolumeClaim: + claimName: vaultwarden-data + - name: vaultwarden-attachments + persistentVolumeClaim: + claimName: vaultwarden-attachments diff --git a/manifests/vaultwarden/ingres.yaml b/manifests/vaultwarden/ingres.yaml new file mode 100644 index 0000000..a7ca856 --- /dev/null +++ b/manifests/vaultwarden/ingres.yaml @@ -0,0 +1,37 @@ + +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: vaultwarden + labels: + app: vaultwarden + app.kubernetes.io/name: vaultwarden + annotations: + cert-manager.io/cluster-issuer: letsencrypt + nginx.ingress.kubernetes.io/force-ssl-redirect: "true" + nginx.ingress.kubernetes.io/ssl-protocols: "TLSv1.2 TLSv1.3" + nginx.ingress.kubernetes.io/proxy-body-size: "100m" + nginx.ingress.kubernetes.io/client-body-buffer-size: 25m + nginx.ingress.kubernetes.io/proxy-connect-timeout: "300" + nginx.ingress.kubernetes.io/proxy-send-timeout: "300" + nginx.ingress.kubernetes.io/proxy-read-timeout: "300" + nginx.ingress.kubernetes.io/proxy-next-upstream: "300" + nginx.ingress.kubernetes.io/proxy-next-upstream-timeout: "300" + nginx.ingress.kubernetes.io/limit-rps: "10" +spec: + ingressClassName: nginx + tls: + - hosts: + - vaultwarden.cluster.fun + secretName: vaultwarden-ingress + rules: + - host: vaultwarden.cluster.fun + http: + paths: + - path: / + pathType: ImplementationSpecific + backend: + service: + name: vaultwarden + port: + name: http diff --git a/manifests/vaultwarden/pv.yaml b/manifests/vaultwarden/pv.yaml new file mode 100644 index 0000000..ebf4f1b --- /dev/null +++ b/manifests/vaultwarden/pv.yaml @@ -0,0 +1,29 @@ +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: vaultwarden-data + labels: + app: vaultwarden + app.kubernetes.io/name: vaultwarden +spec: + accessModes: + - ReadWriteMany + resources: + requests: + storage: 5Gi + storageClassName: sfs-standard-retain +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: vaultwarden-attachments + labels: + app: vaultwarden + app.kubernetes.io/name: vaultwarden +spec: + accessModes: + - ReadWriteMany + resources: + requests: + storage: 5Gi + storageClassName: sfs-standard-retain diff --git a/manifests/vaultwarden/service.yaml b/manifests/vaultwarden/service.yaml new file mode 100644 index 0000000..843464f --- /dev/null +++ b/manifests/vaultwarden/service.yaml @@ -0,0 +1,16 @@ +apiVersion: v1 +kind: Service +metadata: + name: vaultwarden + labels: + app: vaultwarden + app.kubernetes.io/name: vaultwarden +spec: + type: ClusterIP + ports: + - name: http + port: 80 + targetPort: 8080 + protocol: TCP + selector: + app: vaultwarden