Setup Vaultwarden on Kubernetes cluster

kubernetes/argocd/stacks/common/vaultwarden.yml

@@ -0,0 +1,26 @@
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: vaultwarden
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  destination:
+    namespace: vaultwarden
+    server: 'https://kubernetes.default.svc'
+  sources:
+    - path: kubernetes/argocd/stacks/vaultwarden
+      repoURL: 'https://github.com/lowpolyneko/IaC'
+      targetRevision: feature/vaultwarden
+      directory:
+        recurse: true
+        include: '*.yml'
+        exclude: values.yml
+  project: default
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true

kubernetes/argocd/stacks/vaultwarden/vaultwarden.yml

@@ -0,0 +1,168 @@
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRoute
+metadata:
+  name: vaultwarden
+  namespace: vaultwarden
+  annotations:
+    external-dns.alpha.kubernetes.io/target: app.acmuic.org
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - kind: Rule
+      match: "Host(`bitwarden.acmuic.org`)"
+      services:
+        - kind: Service
+          name: vaultwarden
+          namespace: vaultwarden
+          passHostHeader: true
+          port: http
+          responseForwarding:
+            flushInterval: 1ms
+          scheme: http
+          strategy: RoundRobin
+          weight: 10
+  tls:
+    secretName: vaultwarden-tls
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: vaultwarden-tls
+spec:
+  dnsNames:
+    - bitwarden.acmuic.org
+  secretName: vaultwarden-tls
+  issuerRef:
+    kind: ClusterIssuer
+    name: acmuic-self-ca
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: vaultwarden-pvc
+  namespace: vaultwarden
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: nfs
+  resources:
+    requests:
+      storage: 20Gi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: vaultwarden
+  namespace: vaultwarden
+spec:
+  strategy:
+    type: 
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: vaultwarden
+  template:
+    metadata:
+      annotations:
+      labels:
+        app.kubernetes.io/name: vaultwarden
+    spec:
+      volumes:
+        - name: vaultwarden-data
+          persistentVolumeClaim:
+            claimName: vaultwarden-pvc
+      containers:
+        - name: vaultwarden
+          image: vaultwarden/server:latest
+          env:
+            - name: DOMAIN
+              value: 'https://bitwarden.acmuic.org'
+            - name: ADMIN_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: vaultwarden-admin-token
+                  key: admin_token
+          ports:
+            - containerPort: 80
+              name: http
+          volumeMounts:
+            - name: vaultwarden-data
+              mountPath: /data
+        - name: vaultwarden-ldap
+          image: vividboarder/vaultwarden_ldap:latest
+          env:
+            - name: APP_VAULTWARDEN_URL
+              value: 'http://localhost'
+            - name: APP_VAULTWARDEN_ADMIN_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: vaultwarden-admin-token
+                  key: admin_token
+            - name: APP_LDAP_HOST
+              value: 'activedirectory.acmuic.org'
+            - name: APP_LDAP_BIND_DN
+              valueFrom:
+                secretKeyRef:
+                  name: vaultwarden-admin-token
+                  key: ldap_user
+            - name: APP_LDAP_BIND_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: vaultwarden-admin-token
+                  key: ldap_password
+            - name: APP_LDAP_SEARCH_BASE_DN
+              value: 'dc=acmuic,dc=org'
+            - name: APP_LDAP_SEARCH_FILTER
+              value: 'memberOf=CN=ACMLANAdmins,OU=ACMGroups,DC=acmuic,DC=org'
+            - name: APP_LDAP_MAIL_FIELD
+              value: 'userPrincipalName'
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: vaultwarden
+  namespace: vaultwarden
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: vaultwarden-vault-static-auth
+  namespace: vaultwarden
+spec:
+  method: kubernetes
+  mount: kubernetes
+  namespace: vaultwarden
+  kubernetes:
+    role: vaultwarden
+    serviceAccount: vaultwarden
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: vaultwarden-admin-token
+  namespace: vaultwarden
+spec:
+  vaultAuthRef: vaultwarden-vault-static-auth
+  type: kv-v2
+  mount: kv
+  path: vaultwarden
+  destination:
+    name: vaultwarden-admin-token
+    create: true
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: vaultwarden
+  namespace: vaultwarden
+spec:
+  type: ClusterIP
+  ports:
+    - port: 80
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    app.kubernetes.io/name: vaultwarden