Add vaultwarden app (migrated from docker on 10.10.0.5)

- Pinned to 1.37.0 so the migration is not also an upgrade
- ADMIN_TOKEN rotated to an Argon2id PHC string, stored as a SealedSecret.
  The old token was plaintext AND set in config.json, which overrides env --
  both that key and signups_allowed were removed during migration so the
  Deployment is the source of truth. signups had been silently enabled.
- /admin keeps Authentik forward-auth at priority 1000 (Traefik's default
  priority is rule length; the old docker router used 10 vs an implicit 24
  and was therefore bypassed).
- vault.aleshym.co stays private: absent from the k3s public catchall and
  from the Docker Traefik wan entrypoint.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

This commit is contained in:

Claude

2026-07-31 12:44:05 -07:00

parent b7605de60c

commit 1261e238aa

9 changed files with 206 additions and 0 deletions

									
										apps/vaultwarden/namespace.yaml
									
		+4
		
												View File
												
				@@ -0,0 +1,4 @@

				apiVersion: v1

				kind: Namespace

				metadata:

				  name: vaultwarden