a13labs.infra/terraform/modules/apps/vaultwarden/main.tf

resource "kubernetes_namespace" "vaultwarden" {
  metadata {
    name = "vaultwarden"
  }
}

resource "kubernetes_service_account" "vaultwarden" {
  metadata {
    name      = "vaultwarden-sa"
    namespace = kubernetes_namespace.vaultwarden.metadata[0].name
  }

  automount_service_account_token = false
}

resource "kubernetes_config_map" "vaultwarden_config" {
  metadata {
    name      = "vaultwarden-config"
    namespace = kubernetes_namespace.vaultwarden.metadata[0].name
  }

  data = merge({
    DOMAIN                            = "https://${local.app_fqdn}/"
    SIGNUPS_ALLOWED                   = local.signup
    SIGNUPS_VERIFY                    = local.signup_verify
    DATABASE_URL                      = "/data/db.sqlite3"
    ENABLE_WEBSOCKET                  = local.websocket_enabled
    DISABLE_2FA_REMEMBER              = local.disable_2fa_remember
    SHOW_PASSWORD_HINT                = local.show_password_hint
    PASSWORD_HINTS_ALLOWED            = local.password_hints_allowed
    DISABLE_ICON_DOWNLOAD             = local.disable_icon_download
    ICON_SERVICE                      = local.icon_service
    HTTP_REQUEST_BLOCK_NON_GLOBAL_IPS = local.http_request_block_non_global_ips
    EXTENDED_LOGGING                  = local.extended_logging
    SENDS_ALLOWED                     = local.sends_allowed
    TRASH_AUTO_DELETE_DAYS            = local.trash_auto_delete_days
    EVENTS_DAYS_RETAIN                = local.events_days_retain
    ADMIN_SESSION_LIFETIME            = local.admin_session_lifetime
    USE_SENDMAIL                      = "false"
    },
    local.smtp_enabled ? {
      SMTP_HOST                     = var.smtp_host
      SMTP_PORT                     = tostring(var.smtp_port)
      SMTP_SECURITY                 = var.smtp_security
      SMTP_FROM                     = var.smtp_from
      SMTP_FROM_NAME                = var.smtp_from_name
      SMTP_TIMEOUT                  = tostring(var.smtp_timeout)
      SMTP_EMBED_IMAGES             = var.smtp_embed_images ? "true" : "false"
      SMTP_DEBUG                    = var.smtp_debug ? "true" : "false"
      SMTP_ACCEPT_INVALID_CERTS     = var.smtp_accept_invalid_certs ? "true" : "false"
      SMTP_ACCEPT_INVALID_HOSTNAMES = var.smtp_accept_invalid_hostnames ? "true" : "false"
    } : {}
  )
}

resource "kubernetes_secret" "vaultwarden_secrets" {
  metadata {
    name      = "vaultwarden-keys"
    namespace = kubernetes_namespace.vaultwarden.metadata[0].name
  }

  data = merge({
    ADMIN_TOKEN = var.admin_token
    },
    local.smtp_enabled ? {
      SMTP_USERNAME = var.smtp_username
      SMTP_PASSWORD = var.smtp_password
    } : {}
  )
}

resource "kubernetes_deployment" "vaultwarden" {
  metadata {
    name      = "vaultwarden"
    namespace = kubernetes_namespace.vaultwarden.metadata[0].name
    labels = {
      app = "vaultwarden"
    }
  }

  spec {
    replicas = 1

    selector {
      match_labels = {
        app = "vaultwarden"
      }
    }

    strategy {
      type = "Recreate"
    }

    template {
      metadata {
        labels = {
          app              = "vaultwarden"
          config_checksum  = md5(join("", values(kubernetes_config_map.vaultwarden_config.data)))
          secrets_checksum = md5(join("", values(kubernetes_secret.vaultwarden_secrets.data)))
        }
      }

      spec {
        service_account_name            = kubernetes_service_account.vaultwarden.metadata[0].name
        automount_service_account_token = false

        security_context {
          run_as_non_root = true
          run_as_user     = 1000
          run_as_group    = 1000
          fs_group        = 1000

          seccomp_profile {
            type = "RuntimeDefault"
          }
        }

        container {
          name  = "vaultwarden"
          image = "vaultwarden/server:${local.app_version}"

          env_from {
            config_map_ref {
              name = kubernetes_config_map.vaultwarden_config.metadata[0].name
            }
          }

          env {
            name = "ADMIN_TOKEN"
            value_from {
              secret_key_ref {
                name = kubernetes_secret.vaultwarden_secrets.metadata[0].name
                key  = "ADMIN_TOKEN"
              }
            }
          }

          env {
            name = "SMTP_USERNAME"
            value_from {
              secret_key_ref {
                name = kubernetes_secret.vaultwarden_secrets.metadata[0].name
                key  = "SMTP_USERNAME"
              }
            }
          }

          env {
            name = "SMTP_PASSWORD"
            value_from {
              secret_key_ref {
                name = kubernetes_secret.vaultwarden_secrets.metadata[0].name
                key  = "SMTP_PASSWORD"
              }
            }
          }

          env {
            name  = "ROCKET_PORT"
            value = "8080"
          }

          security_context {
            allow_privilege_escalation = false
            privileged                 = false

            capabilities {
              drop = ["ALL"]
            }

            read_only_root_filesystem = true
          }

          port {
            name           = "http"
            container_port = 8080
            protocol       = "TCP"
          }

          liveness_probe {
            http_get {
              path = "/"
              port = "http"
            }
            initial_delay_seconds = 30
            period_seconds        = 15
          }

          readiness_probe {
            http_get {
              path = "/"
              port = "http"
            }
            initial_delay_seconds = 10
            period_seconds        = 10
          }

          volume_mount {
            name       = "vaultwarden-data"
            mount_path = "/data"
          }

          volume_mount {
            name       = "vaultwarden-tmp"
            mount_path = "/tmp"
          }
        }

        volume {
          name = "vaultwarden-data"
          host_path {
            path = local.db_path
            type = "DirectoryOrCreate"
          }
        }

        volume {
          name = "vaultwarden-tmp"
          empty_dir {}
        }
      }
    }
  }
}

resource "kubernetes_service" "vaultwarden" {
  metadata {
    name      = "vaultwarden-service"
    namespace = kubernetes_namespace.vaultwarden.metadata[0].name
  }

  spec {
    selector = {
      app = "vaultwarden"
    }

    port {
      name        = "http"
      port        = 80
      target_port = 8080
    }

    type = "ClusterIP"
  }

  lifecycle {
    ignore_changes = [
      metadata[0].annotations
    ]
  }
}