Initial vaultwarden role

docker compose based vaultwarden, bound to 127.0.0.1, sign ups off, admin panel only with an argon2 token, SMTP via mailcow.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

templates/opt/vaultwarden/.env.j2

@@ -0,0 +1,26 @@
+### BASIC ###
+DOMAIN=https://{{ vaultwarden_domain }}
+LOG_LEVEL={{ vaultwarden_loglevel }}
+IP_HEADER=X-Real-IP
+
+SIGNUPS_ALLOWED={{ vaultwarden_signups_allowed | bool | lower }}
+SIGNUPS_VERIFY={{ vaultwarden_signups_verify | bool | lower }}
+INVITATIONS_ALLOWED={{ vaultwarden_invitations_allowed | bool | lower }}
+INVITATION_ORG_NAME={{ vaultwarden_invitation_org_name }}
+SHOW_PASSWORD_HINT={{ vaultwarden_show_password_hint | bool | lower }}
+PASSWORD_ITERATIONS={{ vaultwarden_password_iterations }}
+
+{# admin panel stays disabled without a token #}
+{% if vaultwarden_admin_token %}
+ADMIN_TOKEN='{{ vaultwarden_admin_token }}'
+{% endif %}
+
+
+### SMTP ###
+SMTP_HOST={{ vaultwarden_smtp_host }}
+SMTP_PORT={{ vaultwarden_smtp_port }}
+SMTP_SECURITY={{ vaultwarden_smtp_security }}
+SMTP_FROM={{ vaultwarden_smtp_from }}
+SMTP_FROM_NAME={{ vaultwarden_smtp_from_name }}
+SMTP_USERNAME={{ vaultwarden_smtp_user }}
+SMTP_PASSWORD='{{ vaultwarden_smtp_pass }}'