From 46bc178dabb95a78992be9d9bfe46f4c9e481a68 Mon Sep 17 00:00:00 2001
From: Aleksandr Bogomiakov <git@hexor.cy>
Date: Sun, 11 Oct 2026 13:00:46 +0100
Subject: [PATCH] Move Vaultwarden local storage and workload to music

---
 k8s-ng/core/vaultwarden/deployment.yaml    |  4 +++-
 k8s-ng/core/vaultwarden/kustomization.yaml |  1 +
 k8s-ng/core/vaultwarden/pvc.yaml           |  7 +++---
 k8s-ng/core/vaultwarden/storage.yaml       | 28 ++++++++++++++++++++++
 4 files changed, 36 insertions(+), 4 deletions(-)
 create mode 100644 k8s-ng/core/vaultwarden/storage.yaml

diff --git a/k8s-ng/core/vaultwarden/deployment.yaml b/k8s-ng/core/vaultwarden/deployment.yaml
index c701e4e..b380b47 100644
--- a/k8s-ng/core/vaultwarden/deployment.yaml
+++ b/k8s-ng/core/vaultwarden/deployment.yaml
@@ -16,6 +16,8 @@ spec:
       labels:
         app: vaultwarden
     spec:
+      nodeSelector:
+        kubernetes.io/hostname: music
       containers:
         - name: vaultwarden
           image: vaultwarden/server:1.37.3
@@ -74,4 +76,4 @@ spec:
       volumes:
         - name: data
           persistentVolumeClaim:
-            claimName: vaultwarden-data
+            claimName: vaultwarden-data-music
diff --git a/k8s-ng/core/vaultwarden/kustomization.yaml b/k8s-ng/core/vaultwarden/kustomization.yaml
index 09ab2ac..3e03c2e 100644
--- a/k8s-ng/core/vaultwarden/kustomization.yaml
+++ b/k8s-ng/core/vaultwarden/kustomization.yaml
@@ -3,6 +3,7 @@ kind: Kustomization
 
 resources:
   - secrets.yaml
+  - storage.yaml
   - pvc.yaml
   - deployment.yaml
   - service.yaml
diff --git a/k8s-ng/core/vaultwarden/pvc.yaml b/k8s-ng/core/vaultwarden/pvc.yaml
index ef62396..3a66877 100644
--- a/k8s-ng/core/vaultwarden/pvc.yaml
+++ b/k8s-ng/core/vaultwarden/pvc.yaml
@@ -1,12 +1,13 @@
 # Attachments, sends, icon cache and RSA keys live here; the database is in PostgreSQL.
-# A local-path volume is bound to one node: the pod stays on the node it first ran on.
+# Bind explicitly to the retained local volume on music (see storage.yaml).
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: vaultwarden-data
+  name: vaultwarden-data-music
 spec:
   accessModes: [ReadWriteOnce]
-  storageClassName: local-path
+  storageClassName: ""
+  volumeName: vaultwarden-data-music
   resources:
     requests:
       storage: 2Gi
diff --git a/k8s-ng/core/vaultwarden/storage.yaml b/k8s-ng/core/vaultwarden/storage.yaml
new file mode 100644
index 0000000..fbc6aee
--- /dev/null
+++ b/k8s-ng/core/vaultwarden/storage.yaml
@@ -0,0 +1,28 @@
+# The directory must contain Vaultwarden's migrated /data before the pod starts.
+# Retain the files when the claim or Argo CD application is removed.
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: vaultwarden-data-music
+  annotations:
+    argocd.argoproj.io/sync-wave: "-1"
+    argocd.argoproj.io/sync-options: Prune=false
+spec:
+  capacity:
+    storage: 2Gi
+  volumeMode: Filesystem
+  accessModes: [ReadWriteOnce]
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: ""
+  claimRef:
+    namespace: vaultwarden
+    name: vaultwarden-data-music
+  local:
+    path: /data/k8s/vaultwarden
+  nodeAffinity:
+    required:
+      nodeSelectorTerms:
+        - matchExpressions:
+            - key: kubernetes.io/hostname
+              operator: In
+              values: [music]