feat: add adminer and vaultwarden apps, integrated from k8s-manifests

apps/vaultwarden/backup.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+APP_NAME="vaultwarden"
+BASE_DIR="$(cd "$(dirname "$0")" && pwd)"
+BACKUP_DIR="$BASE_DIR/backup"
+TIMESTAMP=$(date +%Y%m%d-%H%M)
+
+echo "📦 備份 $APP_NAME..."
+
+mkdir -p "$BACKUP_DIR"
+
+POD=$(kubectl get pod -l "app=$APP_NAME" -o jsonpath="{.items[0].metadata.name}")
+
+if [ -z "$POD" ]; then
+    echo "❌ 找不到 $APP_NAME 的 Pod"
+    exit 1
+fi
+
+echo "備份資料..."
+kubectl exec $POD -- tar czf /tmp/backup.tar.gz /data
+kubectl cp $POD:/tmp/backup.tar.gz "$BACKUP_DIR/$APP_NAME-$TIMESTAMP.tar.gz"
+kubectl exec $POD -- rm /tmp/backup.tar.gz
+
+echo "✅ 備份完成: $BACKUP_DIR/$APP_NAME-$TIMESTAMP.tar.gz"

apps/vaultwarden/deploy.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+BASE_DIR="$(cd "$(dirname "$0")" && pwd)"
+MANIFESTS="$BASE_DIR/manifests"
+
+echo "🚀 部署 Vaultwarden..."
+
+kubectl apply -f "$MANIFESTS/"
+
+echo "⏳ 等待 Pod 就緒..."
+kubectl rollout status deployment/vaultwarden --timeout=120s
+
+echo "✅ Vaultwarden 部署完成"

apps/vaultwarden/manifests/vaultwarden-deployment.yaml

@@ -0,0 +1,39 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: vaultwarden
+  labels:
+    app: vaultwarden
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: vaultwarden
+  template:
+    metadata:
+      labels:
+        app: vaultwarden
+    spec:
+      containers:
+        - name: vaultwarden
+          image: vaultwarden/server:latest
+          resources:
+            limits:
+              memory: "512Mi"
+              cpu: "500m"
+          ports:
+            - containerPort: 80
+          env:
+            - name: WEBSOCKET_ENABLED
+              value: "true"
+            - name: DOMAIN
+              value: "https://vaultwarden.lotimmy.com"
+            - name: ADMIN_TOKEN
+              value: "$$argon2id$$v=19$$m=65540,t=3,p=4$$EVIbGzNlkQUK5b0r7aMgKoUWV98aqrpPevU+8Bbv0EE$$JB51q0ih0LGmw6rp7ZVBgT+PNnCepy+bNYyaChD+VMc"
+          volumeMounts:
+            - mountPath: "/data"
+              name: data-vol
+      volumes:
+        - name: data-vol
+          persistentVolumeClaim:
+            claimName: vaultwarden-pvc

apps/vaultwarden/manifests/vaultwarden-ingress.yaml

@@ -0,0 +1,35 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: vaultwarden-ingress
+  labels:
+    app: vaultwarden
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - vaultwarden.192.168.42.120.nip.io
+      secretName: nip-io-cert
+  rules:
+    - host: vaultwarden.lotimmy.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: vaultwarden-service
+                port:
+                  number: 80
+    - host: vaultwarden.192.168.42.120.nip.io
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: vaultwarden-service
+                port:
+                  number: 80

apps/vaultwarden/manifests/vaultwarden-pvc.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: vaultwarden-pvc
+  labels:
+    app: vaultwarden
+spec:
+  storageClassName: longhorn
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 5Gi

apps/vaultwarden/manifests/vaultwarden-service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: vaultwarden-service
+  labels:
+    app: vaultwarden
+spec:
+  selector:
+    app: vaultwarden
+  ports:
+    - protocol: TCP
+      name: http
+      port: 80
+      targetPort: 80
+  type: ClusterIP

apps/vaultwarden/restore.sh

@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+APP_NAME="vaultwarden"
+BASE_DIR="$(cd "$(dirname "$0")" && pwd)"
+BACKUP_DIR="$BASE_DIR/backup"
+
+if [ $# -eq 0 ]; then
+    echo "用法: $0 <backup-file>"
+    echo ""
+    echo "可用備份:"
+    ls -lh "$BACKUP_DIR/"*.tar.gz 2>/dev/null || echo "無備份檔案"
+    exit 1
+fi
+
+BACKUP_FILE="$1"
+
+if [ ! -f "$BACKUP_FILE" ]; then
+    echo "❌ 備份檔案不存在: $BACKUP_FILE"
+    exit 1
+fi
+
+POD=$(kubectl get pod -l "app=$APP_NAME" -o jsonpath="{.items[0].metadata.name}")
+
+echo "📥 還原 $APP_NAME 從 $BACKUP_FILE..."
+
+kubectl cp "$BACKUP_FILE" $POD:/tmp/restore.tar.gz
+kubectl exec $POD -- tar xzf /tmp/restore.tar.gz -C /
+kubectl exec $POD -- rm /tmp/restore.tar.gz
+
+echo "✅ 還原完成，請重啟 Pod"
+kubectl rollout restart deployment/$APP_NAME

apps/vaultwarden/status.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+APP_NAME="vaultwarden"
+
+echo "=== [ $APP_NAME 資源狀態 ] ==="
+echo ""
+
+echo "--- Pods ---"
+kubectl get pods -l "app=$APP_NAME" -o wide
+
+echo ""
+
+echo "--- Services ---"
+kubectl get svc -l "app=$APP_NAME"
+
+echo ""
+
+echo "--- Storage (PVC) ---"
+kubectl get pvc -l "app=$APP_NAME"
+
+echo ""
+
+echo "--- Access (Ingress) ---"
+kubectl get ingress -l "app=$APP_NAME" -o custom_columns=NAME:.metadata.name,HOSTS:.spec.rules[*].host

apps/vaultwarden/stop.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+echo "🛑 停止 Vaultwarden（保留資料）..."
+
+kubectl delete deployment/vaultwarden --ignore-not-found
+kubectl delete service/vaultwarden-service --ignore-not-found
+kubectl delete ingress/vaultwarden-ingress --ignore-not-found
+
+echo "✅ Vaultwarden 已停止，PVC 資料保留"