- New vaultwarden role — Vaultwarden container with SQLite storage, admin
panel protected by token, Keycloak SSO enabled on second deploy after
the OIDC client secret is available (SSO_ENABLED conditionally set so
first provisioning deploy works without Keycloak being configured yet)
- Traefik routes vault.ladkau.de with lax rate limiting (SPA loads many assets)
- vault.ladkau.de added to DNS table, check-services.sh, status dashboard,
and check-vault.sh (admin token required; SSO secret is post-provisioning)
- Configuration runbook: step 2.6 for Keycloak client, section 6 for
Vaultwarden setup including admin panel, SSO login, and client configuration
Shows live service health (green/red links) and server CPU, RAM, and
disk usage with progress bars. Reads host stats from /host/proc,
checks service endpoints every 30 s, and serves a frosted-glass UI
over a configurable background image (ansible/roles/dashboard/files/bg.jpg).
ml