Make vaultwarden VPN only

The first service to go dark...

ansible/roles/traefik/files/file-provider-main.yml

@@ -10,7 +10,15 @@ http:
           Permissions-Policy: interest-cohort=()
 
     tailscale-only:
-      ipAllowList:
+      ipWhiteList:
         sourceRange:
           - "{{ tailscale_cidr }}"
           - "{{ tailscale_cidr_ipv6 }}"
+
+    private-access:
+      ipWhiteList:
+        sourceRange:
+          - "{{ tailscale_cidr }}"
+          - "{{ tailscale_cidr_ipv6 }}"
+          - "{{ nebula.cidr }}"
+          - "{{ pve_hosts.internal_cidr }}"

ansible/roles/vaultwarden/files/docker-compose.yml

@@ -22,7 +22,7 @@ services:
       - traefik.http.middlewares.vaultwarden-ratelimit.ratelimit.average=5
       - traefik.http.middlewares.vaultwarden-ratelimit.ratelimit.burst=200
 
-      - traefik.http.routers.vaultwarden.middlewares=vaultwarden-ratelimit
+      - traefik.http.routers.vaultwarden.middlewares=vaultwarden-ratelimit,tailscale-only@file
     environment:
       - SIGNUPS_ALLOWED=false
       - DOMAIN=https://vaultwarden.jakehoward.tech