fix: add nginx sidecar for Bitwarden well-known endpoint

This fixes iOS app connection issues by properly responding to
/.well-known/bitwarden/ endpoint which iOS clients use to identify
the server.

apps/vaultwarden/manifests/00-well-known-configmap.yaml

@@ -0,0 +1,30 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: nginx-well-known-config
+data:
+  default.conf: |
+    server {
+      listen 8080;
+      server_name _;
+
+      # Well-known endpoint for Bitwarden clients
+      location /.well-known/bitwarden/ {
+        add_header Content-Type application/json;
+        return 200 '{"object":"bitwarden-bitwarden-host","api":"https://vaultwarden.lotimmy.com"}';
+      }
+
+      # Forward all other requests to Vaultwarden
+      location / {
+          proxy_pass http://127.0.0.1:3000;
+          proxy_set_header Host $host;
+          proxy_set_header X-Real-IP $remote_addr;
+          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+          proxy_set_header X-Forwarded-Proto $scheme;
+
+          # WebSocket support
+          proxy_http_version 1.1;
+          proxy_set_header Upgrade $http_upgrade;
+          proxy_set_header Connection "upgrade";
+      }
+    }

apps/vaultwarden/manifests/vaultwarden-deployment.yaml

@@ -25,7 +25,7 @@ spec:
               memory: "512Mi"
               cpu: "500m"
           ports:
-            - containerPort: 80
+            - containerPort: 3000
           env:
             - name: WEBSOCKET_ENABLED
               value: "true"
@@ -40,7 +40,7 @@ spec:
           livenessProbe:
             httpGet:
               path: /alive
-              port: 80
+              port: 3000
             initialDelaySeconds: 30
             periodSeconds: 10
             timeoutSeconds: 5
@@ -48,7 +48,7 @@ spec:
           readinessProbe:
             httpGet:
               path: /alive
-              port: 80
+              port: 3000
             initialDelaySeconds: 5
             periodSeconds: 10
             timeoutSeconds: 5
@@ -56,7 +56,36 @@ spec:
           volumeMounts:
             - mountPath: "/data"
               name: data-vol
+        - name: nginx-well-known
+          image: nginx:alpine
+          resources:
+            requests:
+              memory: "32Mi"
+              cpu: "50m"
+            limits:
+              memory: "64Mi"
+              cpu: "100m"
+          ports:
+            - containerPort: 8080
+          volumeMounts:
+            - mountPath: "/etc/nginx/conf.d"
+              name: nginx-config
+          livenessProbe:
+            httpGet:
+              path: /alive
+              port: 8080
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          readinessProbe:
+            httpGet:
+              path: /alive
+              port: 8080
+            initialDelaySeconds: 3
+            periodSeconds: 10
       volumes:
         - name: data-vol
           persistentVolumeClaim:
             claimName: vaultwarden-pvc
+        - name: nginx-config
+          configMap:
+            name: nginx-well-known-config

apps/vaultwarden/manifests/vaultwarden-service.yaml

@@ -11,5 +11,5 @@ spec:
     - protocol: TCP
       name: http
       port: 80
-      targetPort: 80
+      targetPort: 8080
   type: ClusterIP