Add Vaultwarden self-hosted password vault at vault.ladkau.de

- New vaultwarden role — Vaultwarden container with SQLite storage, admin
  panel protected by token, Keycloak SSO enabled on second deploy after
  the OIDC client secret is available (SSO_ENABLED conditionally set so
  first provisioning deploy works without Keycloak being configured yet)
- Traefik routes vault.ladkau.de with lax rate limiting (SPA loads many assets)
- vault.ladkau.de added to DNS table, check-services.sh, status dashboard,
  and check-vault.sh (admin token required; SSO secret is post-provisioning)
- Configuration runbook: step 2.6 for Keycloak client, section 6 for
  Vaultwarden setup including admin panel, SSO login, and client configuration

This commit is contained in:

2026-06-28 15:39:42 +02:00

parent 187c6bdea4

commit 1c36b7bbcb

10 changed files with 137 additions and 6 deletions

									
										scripts/check-vault.sh
									
		+1
		
												View File
												
				@@ -39,6 +39,7 @@ required_scalars = [

				    "nextcloud_admin_password",

				    "roundcube_db_password",

				    "roundcube_des_key",

				    "vaultwarden_admin_token",

				]

				# Required non-empty lists (must contain at least one entry)