vaultwarden helm -> docker

apps/vaultwarden/admincreds-secret.yaml

@@ -1,22 +0,0 @@
-apiVersion: v1
-data:
-    ADMIN_TOKEN: ENC[AES256_GCM,data:N0kMJfrvylK/MiG+Yq9IpaPx0Q0=,iv:GR/ZxbKOim54hbryAw5MbktstNZ4upqXi/tsM4CPGmA=,tag:4USciX0i9f0cPK6BAy8zDw==,type:str]
-kind: Secret
-metadata:
-    name: admincreds-secret
-    namespace: vaultwarden
-sops:
-    age:
-        - recipient: age1s0206tnfaaw849x5xmt95axgu8qhxzlu5ywrwz09tpt8lwpx858q089nq9
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiTjhIQUJjRWZzR2VSMldz
-            M2d1YUZ6QWl6Z3hJM0xxMGV6N1d0U2RUTlVFCjZHSTdBOTd1QW5Hb3BsZEc2Ykdv
-            ZElxUTgrVG1EcmM5SGxiNW1WMHRpbWcKLS0tIG91WmRsNzhWa1R1dHZ3QWJqbnQx
-            ZEpndHIyQzllejI0K0t0bkVKOWloYWsKeSb8P3ZijFvLy9IzVDkxMakfyWS7tt8e
-            uo3wrtSTlPHzvozymM/hXVDzKI6XZIZnUBfebGQpk0DgymyYKrwFgw==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-12-17T20:36:08Z"
-    mac: ENC[AES256_GCM,data:sidIbGpK0REcpsX+lQyE6G6/qMH1EWsLzKc6p80X++L5ALzMT3zbKK7JNeGNIpAGdeX+3VF/g2JM5k+mIQdNQUjjxHuej3XQQ1PPKsis7GMpms2PSM9V51GbJ3QSeCW8hLqEDc7fKsB7dYLV+TAcrWtPg/lsV4VJ25eIkCQS7N4=,iv:gdORkFVZj0Rt6Qrx4K+xhk07TwKT6vxPu/sgg0Q/32E=,tag:A0shGOWTVSRPsNDG/kOM9g==,type:str]
-    encrypted_regex: ^(data|stringData)$
-    version: 3.11.0

apps/vaultwarden/config.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: vaultwarden-config
+  namespace: vaultwarden
+data:
+  DOMAIN: "https://vaultwarden.michaelthomson.dev"
+  SIGNUPS_ALLOWED: false
+  SMTP_HOST: mail.michaelthomson.dev
+  SMTP_FROM: server@michaelthomson.dev
+  SMTP_PORT: 465
+  SMTP_SECURITY: force_tls

apps/vaultwarden/deployment.yaml

@@ -0,0 +1,34 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: vaultwarden
+  namespace: vaultwarden
+spec:
+  selector:
+    matchLabels:
+      app: vaultwarden
+  template:
+    metadata:
+      labels:
+        app: vaultwarden
+    spec:
+      containers:
+      - name: vaultwarden
+        image: vaultwarden/server:latest
+        imagePullPolicy: Always
+        envFrom:
+          - secretRef:
+              name: vaultwarden-secret
+          - configMapRef:
+              name: vaultwarden-config
+        ports:
+        - containerPort: 80
+          name: http
+          protocol: TCP
+        volumeMounts:
+        - mountPath: /data
+          name: data
+      volumes:
+      - name: data
+        persistentVolumeClaim: 
+          claimName: vaultwarden-pvc

apps/vaultwarden/ingress.yaml

@@ -0,0 +1,27 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: vaultwarden
+  namespace: vaultwarden
+  annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+    external-dns.alpha.kubernetes.io/target: michaelthomson.ddns.net
+    external-dns.alpha.kubernetes.io/cloudflare-proxied: "true"
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+spec:
+  rules:
+  - host: vaultwarden.michaelthomson.dev
+    http:
+      paths:
+      - pathType: ImplementationSpecific
+        path: /
+        backend:
+          service:
+            name: vaultwarden
+            port: 
+              name: http
+  tls:
+  - hosts:
+    - vaultwarden.michaelthomson.dev
+    secretName: vaultwarden-tls

apps/vaultwarden/pvc.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: vaultwarden-pvc
+  namespace: vaultwarden
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi

apps/vaultwarden/release.yaml

@@ -1,54 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: vaultwarden
-  namespace: vaultwarden
-spec:
-  chart:
-    spec:
-      chart: vaultwarden
-      version: 0.39.x
-      sourceRef:
-        kind: HelmRepository
-        name: vaultwarden
-  interval: 15m
-  releaseName: vaultwarden
-  values:
-    resourceType: Deployment
-    data:
-      name: "vaultwarden-data"
-      size: "15Gi"
-      class: "longhorn"
-      accessMode: "ReadWriteOnce"
-    domain: "https://vaultwarden.michaelthomson.dev"
-    signupsAllowed: false
-    signupsVerify: "true"
-    requireDeviceEmail: "true"
-    adminToken:
-      existingSecret: "admincreds-secret"
-      existingSecretKey: "ADMIN_TOKEN"
-    timeZone: "America/Toronto"
-    smtp:
-      existingSecret: "smtpcreds-secret"
-      host: "mail.michaelthomson.dev"
-      security: "force_tls"
-      port: 465
-      from: "server@michaelthomson.dev"
-      fromName: "Server"
-      username:
-        existingSecretKey: "SMTP_USERNAME"
-      password:
-        existingSecretKey: "SMTP_PASSWORD"
-    ingress:
-      enabled: true
-      class: "traefik"
-      additionalAnnotations:
-        cert-manager.io/cluster-issuer: "letsencrypt-prod"
-        external-dns.alpha.kubernetes.io/target: michaelthomson.ddns.net
-        external-dns.alpha.kubernetes.io/cloudflare-proxied: "true"
-        traefik.ingress.kubernetes.io/router.entrypoints: websecure
-        traefik.ingress.kubernetes.io/router.tls: "true"
-      labels: {}
-      tls: true
-      hostname: "vaultwarden.michaelthomson.dev"
-      tlsSecret: vaultwarden-tls

apps/vaultwarden/repository.yaml

@@ -1,8 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: vaultwarden
-  namespace: vaultwarden
-spec:
-  interval: 15m
-  url: https://guerzon.github.io/vaultwarden

apps/vaultwarden/secret.yaml

@@ -2,9 +2,10 @@ apiVersion: v1
 stringData:
     SMTP_PASSWORD: ENC[AES256_GCM,data:ckVcecLJPGsD4RYEva2TJluXy2TvhS3aYPzxAyEN,iv:AteDpQU+1p5+/nxtgSDhyH/O6dEPrLE6OrN8soMQNGk=,tag:DlaHPDzhBxRDbuuNdNSllw==,type:str]
     SMTP_USERNAME: ENC[AES256_GCM,data:6oCLieSE7U0QIn6+q48oQSEiRKD8fYRe6A==,iv:Ub9f7Hni0N1pvQNfje+EUbXoQHb37v8Wja2u0bvp0/E=,tag:p4VfEXiQEqH3aQNt+9aMPQ==,type:str]
+    ADMIN_TOKEN: ENC[AES256_GCM,data:oUoWtQYgU5oEg7SAEjWqiOYkdaVS0ELwXgdfgaYUglkRdDZ0vOJ7axW4Ah4=,iv:hNBdD5zrut9y8R4nl1z28X9ou3pAvSEv58XLSjeMuUY=,tag:h78hZsfFYbD/35fEa0I2dw==,type:str]
 kind: Secret
 metadata:
-    name: smtpcreds-secret
+    name: vaultwarden-secret
     namespace: vaultwarden
 sops:
     age:
@@ -18,6 +19,6 @@ sops:
             -----END AGE ENCRYPTED FILE-----
           recipient: age1s0206tnfaaw849x5xmt95axgu8qhxzlu5ywrwz09tpt8lwpx858q089nq9
     encrypted_regex: ^(data|stringData)$
-    lastmodified: "2026-06-14T03:38:49Z"
-    mac: ENC[AES256_GCM,data:obLNrjI7ccUOdHwgihPUQ8OpkcpsC0ZWJxi6ddoYcDuwGEtASZjJYAwVWjIb2rvuIrpVAiVQ/WCfz6gAdwIqG9wSJw2FHlMV4h/DiEccZh1r9dVFZ85MHNYMPx05s2xPW30gPuGfSYnrAVlFKhgiJNXOQqguGqRwLIa3/AsmsiI=,iv:98ySRbgzOqrEzlKsbn0Ug5OqPtvuIjZAdwsMhMyD1GE=,tag:0q6u/ubYWZ+coKQkJtT+ZQ==,type:str]
+    lastmodified: "2026-06-21T00:57:10Z"
+    mac: ENC[AES256_GCM,data:iTUsBfc++AdMS0rd2isUEsnU7jp2Pg50KhtWR8J5bBWi/4xyoBVP2fr/c+jAVUMeGVbkZZb+zA6jvaTzhsITKyDwkyVIMShKfXeSLvr9PRMLExkif2DNRzkQ+jRhsnOFdtoUqnKfEN2QtjBJ0OkvN5RrjjMLnlmkswLDhIvQbyo=,iv:WbIIrJf7bpLft8t14XNCeuk88ij8TzkCMMQg0QKQW2o=,tag:sv1Jid832xDdmmOsof4ZGg==,type:str]
     version: 3.13.1

apps/vaultwarden/service.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: vaultwarden
+  namespace: vaultwarden
+spec:
+  selector:
+    app: vaultwarden
+  ports:
+  - port: 80
+    targetPort: http
+    name: http