vaultwarden: sign-ups off by default, and publish on loopback only

SIGNUPS_ALLOWED was hardcoded 'true' in the compose file and turned off by a
separate manual playbook, so every routine run of the deploy - site.yml
included - silently re-opened registration. It is now
vaultwarden_signups_allowed, default false.

The port was published as a bare "8222:80". Docker writes its own iptables
rules ahead of UFW, so Vaultwarden answered plain HTTP on the public
interface, bypassing Caddy and TLS. Now 127.0.0.1:8222; verified closed from
outside.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

ansible/services/vaultwarden/deploy_vaultwarden_playbook.yml

@@ -27,13 +27,16 @@
               container_name: vaultwarden
               restart: unless-stopped
               ports:
-                - "{{ vaultwarden_port }}:80"
+                # Loopback only. Docker writes its own iptables rules AHEAD of
+                # UFW, so a bare "8222:80" was reachable from the internet as
+                # plain HTTP, bypassing Caddy and TLS. Caddy is the only client.
+                - "127.0.0.1:{{ vaultwarden_port }}:80"
               volumes:
                 - ./data:/data
               environment:
                 WEBSOCKET_ENABLED: 'true'
                 DOMAIN: "https://{{ vaultwarden_domain }}"
-                SIGNUPS_ALLOWED: 'true'
+                SIGNUPS_ALLOWED: '{{ vaultwarden_signups_allowed | bool | lower }}'
                 LOG_FILE: /data/vaultwarden.log
 
     - name: Deploy vaultwarden container with docker compose

ansible/services/vaultwarden/vaultwarden_vars.yml

@@ -3,6 +3,13 @@ vaultwarden_dir: /opt/vaultwarden
 vaultwarden_data_dir: "{{ vaultwarden_dir }}/data"
 vaultwarden_port: 8222
 
+# Public registration. OFF: the accounts exist, and this vault is on the open
+# internet. It used to be hardcoded 'true' in the compose file and turned off by
+# a separate manual playbook - so every routine run of the deploy (site.yml
+# included) silently re-opened sign-ups. Flip to true only to add an account,
+# then back.
+vaultwarden_signups_allowed: false
+
 # (subdomain in group_vars/all/main.yml, caddy_sites_dir in roles/caddy_site/defaults/)
 
 # Remote access