Migrate Bitwarden from legacy server to Kubernetes

[mpeterson]

Overview

Migrate the self-hosted Bitwarden (Vaultwarden) instance from the legacy server into the Kubernetes cluster, and establish a backup strategy as part of the migration.

Current State

• Bitwarden is running on a legacy server outside the cluster.
• No backups are currently in place for the Bitwarden data.

Tasks

Backup strategy (pre-migration)

• Establish a backup procedure for the Bitwarden database and attachments on the legacy server before migrating
• Validate backup can be restored successfully

Migration to Kubernetes

• Create the Kubernetes manifests (Deployment, Service, Ingress/HTTPRoute, PVC)
• Create and encrypt required secrets (admin token, database credentials, SMTP config if applicable)
• Set up persistent storage for the database and attachments via democratic-csi
• Migrate data from legacy server to the new PVC
• Configure DNS to point to the new instance
• Validate functionality (login, sync, vault access)
• Decommission the legacy server instance

Ongoing backups (post-migration)

• Ensure Velero daily backups cover the Bitwarden namespace/PVCs
• Verify Bitwarden data is included in the weekly off-site backup (see Enable off-site volume data backups with Velero snapshotMoveData #567)

Notes

• Plan for a maintenance window during DNS cutover to avoid split-brain issues.
• Consider running both instances briefly in parallel to validate before decommissioning the old one.