From e05e073b7cf02c29fe833f3bab3d7164d3660b8b Mon Sep 17 00:00:00 2001 From: Michael Thomson Date: Sat, 20 Jun 2026 21:04:41 -0400 Subject: [PATCH] vaultwarden helm -> docker --- apps/vaultwarden/admincreds-secret.yaml | 22 -------- apps/vaultwarden/config.yaml | 12 +++++ apps/vaultwarden/deployment.yaml | 34 ++++++++++++ apps/vaultwarden/ingress.yaml | 27 ++++++++++ apps/vaultwarden/pvc.yaml | 11 ++++ apps/vaultwarden/release.yaml | 54 ------------------- apps/vaultwarden/repository.yaml | 8 --- .../{smtpcreds-secret.yaml => secret.yaml} | 7 +-- apps/vaultwarden/service.yaml | 12 +++++ 9 files changed, 100 insertions(+), 87 deletions(-) delete mode 100644 apps/vaultwarden/admincreds-secret.yaml create mode 100644 apps/vaultwarden/config.yaml create mode 100644 apps/vaultwarden/deployment.yaml create mode 100644 apps/vaultwarden/ingress.yaml create mode 100644 apps/vaultwarden/pvc.yaml delete mode 100644 apps/vaultwarden/release.yaml delete mode 100644 apps/vaultwarden/repository.yaml rename apps/vaultwarden/{smtpcreds-secret.yaml => secret.yaml} (65%) create mode 100644 apps/vaultwarden/service.yaml diff --git a/apps/vaultwarden/admincreds-secret.yaml b/apps/vaultwarden/admincreds-secret.yaml deleted file mode 100644 index 38ed7b2..0000000 --- a/apps/vaultwarden/admincreds-secret.yaml +++ /dev/null @@ -1,22 +0,0 @@ -apiVersion: v1 -data: - ADMIN_TOKEN: ENC[AES256_GCM,data:N0kMJfrvylK/MiG+Yq9IpaPx0Q0=,iv:GR/ZxbKOim54hbryAw5MbktstNZ4upqXi/tsM4CPGmA=,tag:4USciX0i9f0cPK6BAy8zDw==,type:str] -kind: Secret -metadata: - name: admincreds-secret - namespace: vaultwarden -sops: - age: - - recipient: age1s0206tnfaaw849x5xmt95axgu8qhxzlu5ywrwz09tpt8lwpx858q089nq9 - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiTjhIQUJjRWZzR2VSMldz - M2d1YUZ6QWl6Z3hJM0xxMGV6N1d0U2RUTlVFCjZHSTdBOTd1QW5Hb3BsZEc2Ykdv - ZElxUTgrVG1EcmM5SGxiNW1WMHRpbWcKLS0tIG91WmRsNzhWa1R1dHZ3QWJqbnQx - ZEpndHIyQzllejI0K0t0bkVKOWloYWsKeSb8P3ZijFvLy9IzVDkxMakfyWS7tt8e - uo3wrtSTlPHzvozymM/hXVDzKI6XZIZnUBfebGQpk0DgymyYKrwFgw== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2025-12-17T20:36:08Z" - mac: ENC[AES256_GCM,data:sidIbGpK0REcpsX+lQyE6G6/qMH1EWsLzKc6p80X++L5ALzMT3zbKK7JNeGNIpAGdeX+3VF/g2JM5k+mIQdNQUjjxHuej3XQQ1PPKsis7GMpms2PSM9V51GbJ3QSeCW8hLqEDc7fKsB7dYLV+TAcrWtPg/lsV4VJ25eIkCQS7N4=,iv:gdORkFVZj0Rt6Qrx4K+xhk07TwKT6vxPu/sgg0Q/32E=,tag:A0shGOWTVSRPsNDG/kOM9g==,type:str] - encrypted_regex: ^(data|stringData)$ - version: 3.11.0 diff --git a/apps/vaultwarden/config.yaml b/apps/vaultwarden/config.yaml new file mode 100644 index 0000000..731eb74 --- /dev/null +++ b/apps/vaultwarden/config.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: vaultwarden-config + namespace: vaultwarden +data: + DOMAIN: "https://vaultwarden.michaelthomson.dev" + SIGNUPS_ALLOWED: false + SMTP_HOST: mail.michaelthomson.dev + SMTP_FROM: server@michaelthomson.dev + SMTP_PORT: 465 + SMTP_SECURITY: force_tls diff --git a/apps/vaultwarden/deployment.yaml b/apps/vaultwarden/deployment.yaml new file mode 100644 index 0000000..056115c --- /dev/null +++ b/apps/vaultwarden/deployment.yaml @@ -0,0 +1,34 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: vaultwarden + namespace: vaultwarden +spec: + selector: + matchLabels: + app: vaultwarden + template: + metadata: + labels: + app: vaultwarden + spec: + containers: + - name: vaultwarden + image: vaultwarden/server:latest + imagePullPolicy: Always + envFrom: + - secretRef: + name: vaultwarden-secret + - configMapRef: + name: vaultwarden-config + ports: + - containerPort: 80 + name: http + protocol: TCP + volumeMounts: + - mountPath: /data + name: data + volumes: + - name: data + persistentVolumeClaim: + claimName: vaultwarden-pvc diff --git a/apps/vaultwarden/ingress.yaml b/apps/vaultwarden/ingress.yaml new file mode 100644 index 0000000..5d9e053 --- /dev/null +++ b/apps/vaultwarden/ingress.yaml @@ -0,0 +1,27 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: vaultwarden + namespace: vaultwarden + annotations: + cert-manager.io/cluster-issuer: "letsencrypt-prod" + external-dns.alpha.kubernetes.io/target: michaelthomson.ddns.net + external-dns.alpha.kubernetes.io/cloudflare-proxied: "true" + traefik.ingress.kubernetes.io/router.entrypoints: websecure + traefik.ingress.kubernetes.io/router.tls: "true" +spec: + rules: + - host: vaultwarden.michaelthomson.dev + http: + paths: + - pathType: ImplementationSpecific + path: / + backend: + service: + name: vaultwarden + port: + name: http + tls: + - hosts: + - vaultwarden.michaelthomson.dev + secretName: vaultwarden-tls diff --git a/apps/vaultwarden/pvc.yaml b/apps/vaultwarden/pvc.yaml new file mode 100644 index 0000000..d6c9838 --- /dev/null +++ b/apps/vaultwarden/pvc.yaml @@ -0,0 +1,11 @@ +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: vaultwarden-pvc + namespace: vaultwarden +spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 1Gi diff --git a/apps/vaultwarden/release.yaml b/apps/vaultwarden/release.yaml deleted file mode 100644 index 73ab69c..0000000 --- a/apps/vaultwarden/release.yaml +++ /dev/null @@ -1,54 +0,0 @@ -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: vaultwarden - namespace: vaultwarden -spec: - chart: - spec: - chart: vaultwarden - version: 0.39.x - sourceRef: - kind: HelmRepository - name: vaultwarden - interval: 15m - releaseName: vaultwarden - values: - resourceType: Deployment - data: - name: "vaultwarden-data" - size: "15Gi" - class: "longhorn" - accessMode: "ReadWriteOnce" - domain: "https://vaultwarden.michaelthomson.dev" - signupsAllowed: false - signupsVerify: "true" - requireDeviceEmail: "true" - adminToken: - existingSecret: "admincreds-secret" - existingSecretKey: "ADMIN_TOKEN" - timeZone: "America/Toronto" - smtp: - existingSecret: "smtpcreds-secret" - host: "mail.michaelthomson.dev" - security: "force_tls" - port: 465 - from: "server@michaelthomson.dev" - fromName: "Server" - username: - existingSecretKey: "SMTP_USERNAME" - password: - existingSecretKey: "SMTP_PASSWORD" - ingress: - enabled: true - class: "traefik" - additionalAnnotations: - cert-manager.io/cluster-issuer: "letsencrypt-prod" - external-dns.alpha.kubernetes.io/target: michaelthomson.ddns.net - external-dns.alpha.kubernetes.io/cloudflare-proxied: "true" - traefik.ingress.kubernetes.io/router.entrypoints: websecure - traefik.ingress.kubernetes.io/router.tls: "true" - labels: {} - tls: true - hostname: "vaultwarden.michaelthomson.dev" - tlsSecret: vaultwarden-tls diff --git a/apps/vaultwarden/repository.yaml b/apps/vaultwarden/repository.yaml deleted file mode 100644 index f05d310..0000000 --- a/apps/vaultwarden/repository.yaml +++ /dev/null @@ -1,8 +0,0 @@ -apiVersion: source.toolkit.fluxcd.io/v1 -kind: HelmRepository -metadata: - name: vaultwarden - namespace: vaultwarden -spec: - interval: 15m - url: https://guerzon.github.io/vaultwarden diff --git a/apps/vaultwarden/smtpcreds-secret.yaml b/apps/vaultwarden/secret.yaml similarity index 65% rename from apps/vaultwarden/smtpcreds-secret.yaml rename to apps/vaultwarden/secret.yaml index 69c105e..ed93e47 100644 --- a/apps/vaultwarden/smtpcreds-secret.yaml +++ b/apps/vaultwarden/secret.yaml @@ -2,9 +2,10 @@ apiVersion: v1 stringData: SMTP_PASSWORD: ENC[AES256_GCM,data:ckVcecLJPGsD4RYEva2TJluXy2TvhS3aYPzxAyEN,iv:AteDpQU+1p5+/nxtgSDhyH/O6dEPrLE6OrN8soMQNGk=,tag:DlaHPDzhBxRDbuuNdNSllw==,type:str] SMTP_USERNAME: ENC[AES256_GCM,data:6oCLieSE7U0QIn6+q48oQSEiRKD8fYRe6A==,iv:Ub9f7Hni0N1pvQNfje+EUbXoQHb37v8Wja2u0bvp0/E=,tag:p4VfEXiQEqH3aQNt+9aMPQ==,type:str] + ADMIN_TOKEN: ENC[AES256_GCM,data:oUoWtQYgU5oEg7SAEjWqiOYkdaVS0ELwXgdfgaYUglkRdDZ0vOJ7axW4Ah4=,iv:hNBdD5zrut9y8R4nl1z28X9ou3pAvSEv58XLSjeMuUY=,tag:h78hZsfFYbD/35fEa0I2dw==,type:str] kind: Secret metadata: - name: smtpcreds-secret + name: vaultwarden-secret namespace: vaultwarden sops: age: @@ -18,6 +19,6 @@ sops: -----END AGE ENCRYPTED FILE----- recipient: age1s0206tnfaaw849x5xmt95axgu8qhxzlu5ywrwz09tpt8lwpx858q089nq9 encrypted_regex: ^(data|stringData)$ - lastmodified: "2026-06-14T03:38:49Z" - mac: ENC[AES256_GCM,data:obLNrjI7ccUOdHwgihPUQ8OpkcpsC0ZWJxi6ddoYcDuwGEtASZjJYAwVWjIb2rvuIrpVAiVQ/WCfz6gAdwIqG9wSJw2FHlMV4h/DiEccZh1r9dVFZ85MHNYMPx05s2xPW30gPuGfSYnrAVlFKhgiJNXOQqguGqRwLIa3/AsmsiI=,iv:98ySRbgzOqrEzlKsbn0Ug5OqPtvuIjZAdwsMhMyD1GE=,tag:0q6u/ubYWZ+coKQkJtT+ZQ==,type:str] + lastmodified: "2026-06-21T00:57:10Z" + mac: ENC[AES256_GCM,data:iTUsBfc++AdMS0rd2isUEsnU7jp2Pg50KhtWR8J5bBWi/4xyoBVP2fr/c+jAVUMeGVbkZZb+zA6jvaTzhsITKyDwkyVIMShKfXeSLvr9PRMLExkif2DNRzkQ+jRhsnOFdtoUqnKfEN2QtjBJ0OkvN5RrjjMLnlmkswLDhIvQbyo=,iv:WbIIrJf7bpLft8t14XNCeuk88ij8TzkCMMQg0QKQW2o=,tag:sv1Jid832xDdmmOsof4ZGg==,type:str] version: 3.13.1 diff --git a/apps/vaultwarden/service.yaml b/apps/vaultwarden/service.yaml new file mode 100644 index 0000000..ae70a6c --- /dev/null +++ b/apps/vaultwarden/service.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: Service +metadata: + name: vaultwarden + namespace: vaultwarden +spec: + selector: + app: vaultwarden + ports: + - port: 80 + targetPort: http + name: http