dependabot[bot]
0cdeed366a
Bumps the go_modules group with 1 update in the /pulumi directory: [github.com/go-git/go-git/v5](https://github.com/go-git/go-git). Updates `github.com/go-git/go-git/v5` from 5.19.0 to 5.19.1 - [Release notes](https://github.com/go-git/go-git/releases) - [Changelog](https://github.com/go-git/go-git/blob/main/HISTORY.md) - [Commits](https://github.com/go-git/go-git/compare/v5.19.0...v5.19.1) --- updated-dependencies: - dependency-name: github.com/go-git/go-git/v5 dependency-version: 5.19.1 dependency-type: indirect dependency-group: go_modules ... Signed-off-by: dependabot[bot] <support@github.com>
Vaultwarden self-host deployment
Reproducible, single-user, zero-knowledge Vaultwarden on Hetzner Cloud + AlmaLinux 10 with rootless Podman quadlets, custom Caddy (DNS-01 + Coraza DetectionOnly), restic backups to Cloudflare R2, and WireGuard-gated admin access.
Plan: ~/.claude/plans/vaultwarden-self-host-sharded-creek.md.
Layout
| Path | Purpose |
|---|---|
cloudbuild.yaml |
Cloud Build pipeline — drives Pulumi + image build + Ansible |
pulumi/ |
Phase 1: Hetzner server, Cloud Firewall, volume, GCP Cloud DNS records (Pulumi Go) |
caddy/ |
Phase 2: custom Caddy build (Containerfile + pinned versions) and the Caddyfile |
ansible/ |
Phase 3: OS hardening, WireGuard server, nftables, fail2ban, msmtp, dnf-automatic, Secret Manager → Podman secrets |
quadlets/ |
Phase 4: rootless Vaultwarden + Caddy quadlet units |
backup/ |
Phase 5: SQLite-snapshot + restic + systemd timer + Healthchecks pings |
runbook/ |
Deployment runbook, cutover checklist, restore drill |
secrets/ |
Docs only — secret material lives in Google Cloud Secret Manager, fetched at deploy time |
Stack
| Layer | Choice |
|---|---|
| Compute | Hetzner Cloud, CX22, AlmaLinux 10 (alma-10 image) |
| IaC | Pulumi (Go) |
| OS config | Ansible |
| Build / deploy pipeline | Google Cloud Build (image build, Trivy scan, Pulumi, Ansible) |
| Secrets | Google Cloud Secret Manager (OIDC via Cloud Build SA; ADC for local operator) |
| Reverse proxy / TLS / WAF | Caddy (custom: googleclouddns DNS-01 + Coraza DetectionOnly) |
| Network filtering | Hetzner Cloud Firewall + host nftables + Fail2Ban |
| Containers | Rootless Podman quadlets, SELinux enforcing |
| DB | SQLite (single-user; no replication required) |
| Updates | dnf-automatic (OS) + podman auto-update (containers) |
| Backups | restic → Cloudflare R2 |
| DNS | GCP Cloud DNS |
| Admin/SSH gating | WireGuard server on the Vaultwarden host |
| Alerting | Healthchecks.io (timer pings) + msmtp email (systemd OnFailure=) |
Build-it-disposably-first
Two Pulumi stacks: disposable (throwaway hostname, no real vault data) and production.
Iterate pulumi destroy && pulumi up on disposable until the stack stands up cleanly
with zero hand-intervention, then promote to production for migration.
Pinned versions
See memory/coraza_caddy_version.md for the Coraza/Caddy version pinning rationale.