vaultwarden

clusters/base/apps/vaultwarden/helmrelease.yaml

@@ -0,0 +1,66 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: vaultwarden
+  namespace: vaultwarden
+spec:
+  interval: 30m
+  chartRef:
+    kind: OCIRepository
+    name: app-template
+  values:
+    controllers:
+      vaultwarden:
+        containers:
+          app:
+            image:
+              repository: vaultwarden/server
+              tag: latest   # запинить конкретную версию перед продом
+            env:
+              DOMAIN: "https://vw.aggtaa.com"
+              SIGNUPS_ALLOWED: "false"
+              WEBSOCKET_ENABLED: "true"
+              ADMIN_TOKEN:
+                valueFrom:
+                  secretKeyRef:
+                    name: vaultwarden-secrets
+                    key: ADMIN_TOKEN
+            probes:
+              liveness:
+                enabled: true
+              readiness:
+                enabled: true
+
+    service:
+      app:
+        controller: vaultwarden
+        ports:
+          http:
+            port: 80
+
+    ingress:
+      app:
+        className: traefik
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-prod
+        hosts:
+          - host: vw.aggtaa.com
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - secretName: vaultwarden-tls
+            hosts:
+              - vw.aggtaa.com
+
+    persistence:
+      data:
+        type: persistentVolumeClaim
+        storageClass: longhorn
+        accessMode: ReadWriteOnce
+        size: 2Gi
+        globalMounts:
+          - path: /data

clusters/base/apps/vaultwarden/helmrepository.yaml

@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: app-template
+  namespace: vaultwarden
+spec:
+  interval: 1h
+  url: oci://ghcr.io/bjw-s-labs/helm/app-template
+  ref:
+    tag: "5.0.1"

clusters/base/apps/vaultwarden/kustomization.yaml

@@ -1,3 +1,6 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-resources: []
+resources:
+  - helmrepository.yaml
+  - secret.enc.yaml
+  - helmrelease.yaml

clusters/base/apps/vaultwarden/secret.enc.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: vaultwarden-secrets
+    namespace: vaultwarden
+stringData:
+    #ENC[AES256_GCM,data:W5EyfACtGs9eoWsTiPFuWHKYgsafjW7RB5UnrWx08HiNosxUvnjj9nwuNH4FCTQvEH0ozH1MkrcB,iv:E3JPmxdtypvICkklLUlwJaGuEHNIZg1WH2TMLgmYhjU=,tag:qosaGqzTKy82W4+PoY7P4Q==,type:comment]
+    ADMIN_TOKEN: ENC[AES256_GCM,data:2B4IxwEPF7iQOo837uQ0ZKiPwp3ZufXUiQ2IO5j5S1yRBWQo+SFj4lS1l89/VFEmS7NdHQcvlabOgnzaL2LshKx0cQVAlHk9OUALnjJFhD73rmditlUWDK+xnAnCZ4j3E9p5rCPYqQCbox86Yn+5i6UccE/29A==,iv:02FH5ioq16ZQ7inigTCvP0h3WmqFcHK1HswRkdovGlI=,tag:IGRmkwCPFA+rqfx0LseLiQ==,type:str]
+sops:
+    age:
+        - recipient: age109zta6l0cwpkxn5wek82kvauxn6yqrq80rsz4mvu5atdnpcn9pusuvnqk5
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwZmxkbTFHTEo2MnVlTFVh
+            QkVabkRQQncvUVg2TUlCMnZxVlFVUVpaVnprCkZEckR6d2Fua2dMbHQwUlQzUSs2
+            bWRJa2R0U2xEZXBRNGNlTWlTUEdudncKLS0tIHdTY3IxVWpySWN5RExiTGlEVEd5
+            NGNyWVo1dkxMaGplaUppcUZDOTNTY2MKegiSllUBePt+4lzL15AEJ1NMj9VmvH+9
+            EuWICGehLYcBw7SNftpPmJhrNK/HAYdLV+SPg6Qfzwh9cZtYp0Y1Ww==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-08-26T10:17:30Z"
+    mac: ENC[AES256_GCM,data:nmPeyQbJexYyrIdx7htBXR8t2K7VEY4q2nqCRaYMz6OAg4L+7kkyFBPB2mYZ7w4FLJJoTGtFrtC0RSNCdKm7inUOaQjgCbJNoY6BD9xuOj5gJQ6DwliwOz7m1NjBwMt9jNFgXAw5jhX3l5GYBbbnE9htji0xOnWvVGKQ8/dNsGM=,iv:tWMYlI4n7gT19LGck+Y//xCCrCd18LSIUQTyi0ghb6E=,tag:7H5uTGClqDuTuVqmR7onXw==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0