apiVersion: v1
kind: Service
metadata:
  name: vaultwarden
  namespace: vaultwarden
spec:
  selector:
    app: vaultwarden
  ports:
    - name: http
      port: 80
      targetPort: 80
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: vaultwarden
  namespace: vaultwarden
spec:
  serviceName: vaultwarden
  replicas: 1
  selector:
    matchLabels:
      app: vaultwarden
  template:
    metadata:
      labels:
        app: vaultwarden
    spec:
      containers:
        - name: vaultwarden
          image: vaultwarden/server:1.35.6-alpine
          ports:
            - name: http
              containerPort: 80
          env:
            - name: DOMAIN
              value: "https://vault.jsme.be"
            - name: SIGNUPS_ALLOWED
              value: "false"
            - name: ADMIN_TOKEN
              valueFrom:
                secretKeyRef:
                  name: vaultwarden-secrets
                  key: admin_token
            - name: SMTP_HOST
              valueFrom:
                secretKeyRef:
                  name: vaultwarden-secrets
                  key: smtp_host
            - name: SMTP_FROM
              valueFrom:
                secretKeyRef:
                  name: vaultwarden-secrets
                  key: smtp_from
            - name: SMTP_PORT
              valueFrom:
                secretKeyRef:
                  name: vaultwarden-secrets
                  key: smtp_port
            - name: SSO_ENABLED
              value: "true"
            - name: SSO_AUTHORITY
              valueFrom:
                secretKeyRef:
                  name: vaultwarden-secrets
                  key: sso_authority
            - name: SSO_CLIENT_ID
              valueFrom:
                secretKeyRef:
                  name: vaultwarden-secrets
                  key: sso_client_id
            - name: SSO_CLIENT_SECRET
              valueFrom:
                secretKeyRef:
                  name: vaultwarden-secrets
                  key: sso_client_secret
            - name: SSO_SCOPES
              value: "email profile offline_access"
            - name: SSO_ALLOW_UNKNOWN_EMAIL_VERIFICATION
              value: "false"
            - name: SSO_CLIENT_CACHE_EXPIRATION
              value: "0"
            - name: SSO_ONLY
              value: "true"
            - name: SSO_SIGNUPS_MATCH_EMAIL
              value: "true"
            - name: SMTP_SECURITY
              value: "starttls"
            - name: SMTP_USERNAME
              valueFrom:
                secretKeyRef:
                  name: vaultwarden-secrets
                  key: smtp_username
            - name: SMTP_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: vaultwarden-secrets
                  key: smtp_password
          volumeMounts:
            - name: vaultwarden-data
              mountPath: /data
          livenessProbe:
            httpGet:
              path: /alive
              port: 80
            initialDelaySeconds: 15
            periodSeconds: 30
            failureThreshold: 3
          readinessProbe:
            httpGet:
              path: /alive
              port: 80
            initialDelaySeconds: 10
            periodSeconds: 10
            failureThreshold: 3
      volumes:
        - name: vaultwarden-data
          persistentVolumeClaim:
            claimName: vaultwarden-data