From ef36775a09c62627458032c11ecd8437312be7ee Mon Sep 17 00:00:00 2001
From: Jay Phillips <jay@home.lan>
Date: Mon, 15 Jun 2026 19:28:58 +0000
Subject: [PATCH] Add Vaultwarden

---
 apps/vaultwarden/manifests/vaultwarden.yaml | 91 +++++++++++++++++++++
 apps/vaultwarden/vaultwarden.yaml           | 20 +++++
 2 files changed, 111 insertions(+)
 create mode 100644 apps/vaultwarden/manifests/vaultwarden.yaml
 create mode 100644 apps/vaultwarden/vaultwarden.yaml

diff --git a/apps/vaultwarden/manifests/vaultwarden.yaml b/apps/vaultwarden/manifests/vaultwarden.yaml
new file mode 100644
index 0000000..bf8407e
--- /dev/null
+++ b/apps/vaultwarden/manifests/vaultwarden.yaml
@@ -0,0 +1,91 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: vaultwarden
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: vaultwarden-data
+  namespace: vaultwarden
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 10Gi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: vaultwarden
+  namespace: vaultwarden
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: vaultwarden
+  template:
+    metadata:
+      labels:
+        app: vaultwarden
+    spec:
+      containers:
+      - name: vaultwarden
+        image: vaultwarden/server:latest
+        ports:
+        - containerPort: 80
+        env:
+        - name: DOMAIN
+          value: "https://vault.home.lan"
+        - name: SIGNUPS_ALLOWED
+          value: "true"
+        - name: WEBSOCKET_ENABLED
+          value: "true"
+        - name: INVITATIONS_ALLOWED
+          value: "true"
+        volumeMounts:
+        - name: data
+          mountPath: /data
+      volumes:
+      - name: data
+        persistentVolumeClaim:
+          claimName: vaultwarden-data
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: vaultwarden
+  namespace: vaultwarden
+spec:
+  selector:
+    app: vaultwarden
+  ports:
+  - port: 80
+    targetPort: 80
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: vaultwarden
+  namespace: vaultwarden
+  annotations:
+    cert-manager.io/cluster-issuer: home-lab-ca
+spec:
+  ingressClassName: nginx
+  tls:
+  - hosts:
+    - vault.home.lan
+    secretName: vault-home-lan-tls
+  rules:
+  - host: vault.home.lan
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: vaultwarden
+            port:
+              number: 80
diff --git a/apps/vaultwarden/vaultwarden.yaml b/apps/vaultwarden/vaultwarden.yaml
new file mode 100644
index 0000000..6dc7600
--- /dev/null
+++ b/apps/vaultwarden/vaultwarden.yaml
@@ -0,0 +1,20 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: vaultwarden
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: http://git.home.lan/jay/k8s-gitops.git
+    targetRevision: main
+    path: apps/vaultwarden/manifests
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: vaultwarden
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true