Dustin C. Hatch
94be854bd7
Vaultwarden requires basically no configuration anymore. Older versions needed some environment variables for configuring the WebSocket server, but as of 1.31, WebSockets are handled by the same server as HTTP, so even that is not necessary now. The only other option that could potentially be useful is `ADMIN_TOKEN`, but it's optional. For added security, we can leave it unset, which disables the administration console; we can set it later if/when we actually need that feature. Migrating data from the old server was pretty simple. The database is pretty small, and even the attachments and site icons don't take up much space. All-in-all, there was only about 20 MB to move, so the copy only took a few seconds. Aside from moving the Vaultwarden server itself, we will also need to adjust the HAProxy configuration to proxy requests to the Kubernetes ingress controller.
96 lines
2.0 KiB
YAML
96 lines
2.0 KiB
YAML
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata:
|
|
name: vaultwarden
|
|
labels:
|
|
app.kubernetes.io/name: vaultwarden
|
|
app.kubernetes.io/component: vaultwarden
|
|
spec:
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
resources:
|
|
requests:
|
|
storage: 4Gi
|
|
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: vaultwarden
|
|
labels: &labels
|
|
app.kubernetes.io/name: vaultwarden
|
|
app.kubernetes.io/component: vaultwarden
|
|
spec:
|
|
selector: *labels
|
|
ports:
|
|
- port: 8080
|
|
targetPort: http
|
|
name: http
|
|
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: StatefulSet
|
|
metadata:
|
|
name: vaultwarden
|
|
labels: &labels
|
|
app.kubernetes.io/name: vaultwarden
|
|
app.kubernetes.io/component: vaultwarden
|
|
spec:
|
|
serviceName: vaultwarden
|
|
selector:
|
|
matchLabels: *labels
|
|
template:
|
|
metadata:
|
|
labels: *labels
|
|
spec:
|
|
containers:
|
|
- name: vaultwarden
|
|
image: ghcr.io/dani-garcia/vaultwarden
|
|
env:
|
|
- name: ROCKET_PORT
|
|
value: '8080'
|
|
envFrom:
|
|
- configMapRef:
|
|
name: vaultwarden
|
|
optional: true
|
|
- secretRef:
|
|
name: vaultwarden
|
|
optional: true
|
|
ports:
|
|
- name: http
|
|
containerPort: 8080
|
|
readinessProbe: &probe
|
|
httpGet:
|
|
port: http
|
|
path: /alive
|
|
failureThreshold: 1
|
|
periodSeconds: 60
|
|
timeoutSeconds: 5
|
|
startupProbe:
|
|
<<: *probe
|
|
failureThreshold: 60
|
|
initialDelaySeconds: 2
|
|
periodSeconds: 1
|
|
timeoutSeconds: 1
|
|
securityContext:
|
|
readOnlyRootFilesystem: true
|
|
volumeMounts:
|
|
- mountPath: /data
|
|
name: data
|
|
subPath: data
|
|
- mountPath: /tmp
|
|
name: tmp
|
|
subPath: tmp
|
|
securityContext:
|
|
runAsUser: 266
|
|
runAsGroup: 266
|
|
fsGroup: 266
|
|
fsGroupChangePolicy: OnRootMismatch
|
|
volumes:
|
|
- name: data
|
|
persistentVolumeClaim:
|
|
claimName: vaultwarden
|
|
- name: tmp
|
|
emptyDir:
|
|
medium: Memory
|