Add Vaultwarden self-hosted password vault at vault.ladkau.de

- New vaultwarden role — Vaultwarden container with SQLite storage, admin
  panel protected by token, Keycloak SSO enabled on second deploy after
  the OIDC client secret is available (SSO_ENABLED conditionally set so
  first provisioning deploy works without Keycloak being configured yet)
- Traefik routes vault.ladkau.de with lax rate limiting (SPA loads many assets)
- vault.ladkau.de added to DNS table, check-services.sh, status dashboard,
  and check-vault.sh (admin token required; SSO secret is post-provisioning)
- Configuration runbook: step 2.6 for Keycloak client, section 6 for
  Vaultwarden setup including admin panel, SSO login, and client configuration

This commit is contained in:

2026-06-28 15:39:42 +02:00

parent 187c6bdea4

commit 1c36b7bbcb

10 changed files with 137 additions and 6 deletions

									
										ansible/roles/vaultwarden/handlers/main.yml
									
		+7
		
												View File
												
				@@ -0,0 +1,7 @@

				---

				- name: Restart vaultwarden

				  community.docker.docker_compose_v2:

				    project_src: "{{ vaultwarden_data_dir }}"

				    state: present

				    pull: missing

				    recreate: always