Initial vaultwarden role

docker compose based vaultwarden, bound to 127.0.0.1, sign ups off, admin panel only with an argon2 token, SMTP via mailcow.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -0,0 +1,11 @@
+# cloud-vaultwarden
+
+Ansible role to setup vaultwarden (Bitwarden compatible password manager) via docker compose.
+
+- listens on `127.0.0.1:<vaultwarden_http_port>` only; expose it with the nginx role (TLS)
+- sign ups are disabled by default; invite family members from an organization instead
+- the admin panel is disabled unless `vaultwarden_admin_token` (argon2 PHC string) is set;
+  block `/admin` in the public nginx site and reach it through an SSH tunnel
+- do NOT put a forward-auth (e.g. authentik) in front of it, the Bitwarden clients talk to the API directly
+- data lives in `vaultwarden_data_location`; back up `db.sqlite3` with `sqlite3 .backup`, plus
+  `attachments`, `sends`, `config.json` and the `rsa_key*` files