ml
1c36b7bbcb
- New vaultwarden role — Vaultwarden container with SQLite storage, admin panel protected by token, Keycloak SSO enabled on second deploy after the OIDC client secret is available (SSO_ENABLED conditionally set so first provisioning deploy works without Keycloak being configured yet) - Traefik routes vault.ladkau.de with lax rate limiting (SPA loads many assets) - vault.ladkau.de added to DNS table, check-services.sh, status dashboard, and check-vault.sh (admin token required; SSO secret is post-provisioning) - Configuration runbook: step 2.6 for Keycloak client, section 6 for Vaultwarden setup including admin panel, SSO login, and client configuration
38 lines
1.4 KiB
Django/Jinja
38 lines
1.4 KiB
Django/Jinja
# Managed by Ansible — do not edit manually
|
|
services:
|
|
vaultwarden:
|
|
image: vaultwarden/server:{{ vaultwarden_version }}
|
|
container_name: vaultwarden
|
|
restart: unless-stopped
|
|
environment:
|
|
DOMAIN: "https://{{ domain_vault }}"
|
|
# Admin panel at /admin/ — use a long random token
|
|
ADMIN_TOKEN: "{{ vaultwarden_admin_token }}"
|
|
# Disable public sign-up — accounts created via SSO or admin panel
|
|
SIGNUPS_ALLOWED: "false"
|
|
{% if vaultwarden_sso_client_secret | default('') %}
|
|
# SSO via Keycloak — enabled after Keycloak client is configured (step 2.6)
|
|
SSO_ENABLED: "true"
|
|
SSO_CLIENT_ID: "vaultwarden"
|
|
SSO_CLIENT_SECRET: "{{ vaultwarden_sso_client_secret }}"
|
|
SSO_AUTHORITY: "https://{{ domain_sso }}/realms/ladkau"
|
|
{% else %}
|
|
SSO_ENABLED: "false"
|
|
{% endif %}
|
|
volumes:
|
|
- {{ vaultwarden_data_dir }}/data:/data
|
|
networks:
|
|
- traefik_public
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.http.routers.vaultwarden.rule=Host(`{{ domain_vault }}`)"
|
|
- "traefik.http.routers.vaultwarden.entrypoints=websecure"
|
|
- "traefik.http.routers.vaultwarden.tls.certresolver=letsencrypt"
|
|
- "traefik.http.services.vaultwarden.loadbalancer.server.port=80"
|
|
# Lax rate limit — Vaultwarden SPA loads many assets on first visit
|
|
- "traefik.http.routers.vaultwarden.middlewares=rate-limit-lax@docker"
|
|
|
|
networks:
|
|
traefik_public:
|
|
external: true
|