Add Vaultwarden self-hosted password vault at vault.ladkau.de

- New vaultwarden role — Vaultwarden container with SQLite storage, admin
  panel protected by token, Keycloak SSO enabled on second deploy after
  the OIDC client secret is available (SSO_ENABLED conditionally set so
  first provisioning deploy works without Keycloak being configured yet)
- Traefik routes vault.ladkau.de with lax rate limiting (SPA loads many assets)
- vault.ladkau.de added to DNS table, check-services.sh, status dashboard,
  and check-vault.sh (admin token required; SSO secret is post-provisioning)
- Configuration runbook: step 2.6 for Keycloak client, section 6 for
  Vaultwarden setup including admin panel, SSO login, and client configuration

docs/runbook-configuration.md

@@ -23,6 +23,7 @@ The script checks these endpoints and verifies the expected HTTP status code:
 | `https://mail.ladkau.de` | 200 | Roundcube webmail login |
 | `https://cr.ladkau.de/v2/` | 401 | Registry API — auth required, correct without credentials |
 | `https://k8s.ladkau.de` | 200 | Placeholder page |
+| `https://vault.ladkau.de` | 200 | Vaultwarden web vault |
 
 A `000` result means the connection was refused or timed out — a container that
 did not start. Keycloak and Nextcloud may return `502` for up to 90 seconds on
@@ -91,6 +92,21 @@ For each user you want to be able to log in to Gitea and Nextcloud:
 7. Go to the **Credentials** tab and copy the **Client secret** — you will
    need it in step 4.
 
+### 2.6 Create the Vaultwarden OIDC client
+
+1. **Clients** → **Create client**.
+2. **Client type**: OpenID Connect — **Client ID**: `vaultwarden` → **Next**.
+3. Turn **Client authentication** on → **Next**.
+4. **Valid redirect URIs**: `https://vault.ladkau.de/*`
+5. **Valid post logout redirect URIs**: `https://vault.ladkau.de/*`
+6. **Web origins**: `https://vault.ladkau.de` → **Save**.
+7. Go to the **Credentials** tab and copy the **Client secret**.
+8. Add it to the vault as `vaultwarden_sso_client_secret` and redeploy:
+   ```bash
+   ansible-vault edit ansible/group_vars/all/vault.yml
+   ansible-playbook -i ansible/inventory.ini ansible/site.yml --tags vaultwarden --ask-vault-pass
+   ```
+
 ## 3. Gitea
 
 ### 3.1 Create the admin account
@@ -196,7 +212,29 @@ imapsync \
 | Security  | SSL/TLS              |
 | Username  | as set in vault      |
 
-## 6. Container registry
+## 6. Vaultwarden
+
+Vaultwarden is a self-hosted Bitwarden-compatible password vault. Any official
+Bitwarden client (browser extension, desktop, mobile) can connect to it.
+
+### 6.1 Log in to the admin panel
+
+Go to `https://vault.ladkau.de/admin/` and enter the `vaultwarden_admin_token`
+from the vault. From here you can invite users and manage the instance.
+
+### 6.2 Sign in with Keycloak SSO
+
+Users can sign in at `https://vault.ladkau.de` using the **Enterprise Single
+Sign-On** button — enter `https://sso.ladkau.de/realms/ladkau` as the
+organisation identifier. On first login Vaultwarden creates an account
+automatically (public self-registration is otherwise disabled).
+
+### 6.3 Connect a Bitwarden client
+
+In any official Bitwarden client, set the **Server URL** to
+`https://vault.ladkau.de` before logging in.
+
+## 7. Container registry
 
 ```bash
 # Login

docs/runbook-provisioning.md

@@ -78,6 +78,7 @@ Let's Encrypt certificates on first start and DNS must resolve at that point.
 | mail.ladkau.de      | A → server IP |
 | cr.ladkau.de        | A → server IP |
 | k8s.ladkau.de       | A → server IP |
+| vault.ladkau.de     | A → server IP |
 
 ### 4. Create the vault and populate secrets
 
@@ -118,17 +119,23 @@ registry_users:
   - username: alice
     password: "your-password"
 
-# Dovecot IMAP users — generate with: openssl rand -hex 32
+# Vaultwarden password vault
+vaultwarden_admin_token: ""        # generate: openssl rand -hex 32
+# vaultwarden_sso_client_secret is added after Keycloak is configured — see
+# step 2.6 of runbook-configuration.md
+
+# Dovecot IMAP users
 dovecot_users:
   - username: alice
     password: "your-password"
 
 # Fetchmail — external POP3 accounts to pull from (omit section if not needed)
+# local_user must match a username defined in dovecot_users above
 # fetchmail_accounts:
 #   - server: pop.gmail.com
 #     username: user@gmail.com
 #     password: app-password    # use a Gmail App Password, not your main password
-#     local_user: alice
+#     local_user: alice         # must match a dovecot_users entry
 #     ssl: true
 #     keep: true                # set false to delete from source after fetching
 #     poll_minutes: 10          # how often to poll this account (default: 10)
@@ -188,8 +195,9 @@ This runs all roles in order:
 | 6 | `sso`      | Keycloak single sign-on with PostgreSQL |
 | 7 | `mail`     | Roundcube webmail client with PostgreSQL |
 | 8 | `registry` | Docker Registry v2 with htpasswd auth |
-| 9 | `k8s`      | Placeholder page at k8s.ladkau.de |
-| 10 | `dashboard` | Public status dashboard at cloud.ladkau.de — service health and server stats |
+| 9 | `k8s`         | Placeholder page at k8s.ladkau.de |
+| 10 | `vaultwarden` | Vaultwarden password vault at vault.ladkau.de |
+| 11 | `dashboard`   | Public status dashboard at cloud.ladkau.de — service health and server stats |
 
 To apply a single role: