Add Vaultwarden self-hosted password vault at vault.ladkau.de

- New vaultwarden role — Vaultwarden container with SQLite storage, admin
  panel protected by token, Keycloak SSO enabled on second deploy after
  the OIDC client secret is available (SSO_ENABLED conditionally set so
  first provisioning deploy works without Keycloak being configured yet)
- Traefik routes vault.ladkau.de with lax rate limiting (SPA loads many assets)
- vault.ladkau.de added to DNS table, check-services.sh, status dashboard,
  and check-vault.sh (admin token required; SSO secret is post-provisioning)
- Configuration runbook: step 2.6 for Keycloak client, section 6 for
  Vaultwarden setup including admin panel, SSO login, and client configuration

This commit is contained in:

2026-06-28 15:39:42 +02:00

parent 187c6bdea4

commit 1c36b7bbcb

10 changed files with 137 additions and 6 deletions

									
										ansible/site.yml
									
		+1
		
												View File
												
				@@ -12,4 +12,5 @@

				    - mail

				    - registry

				    - k8s

				    - vaultwarden

				    - dashboard