diff --git a/.gitea/workflows/vaultwarden.yml b/.gitea/workflows/vaultwarden.yml
new file mode 100644
index 0000000..0f34974
--- /dev/null
+++ b/.gitea/workflows/vaultwarden.yml
@@ -0,0 +1,27 @@
+name: Vaultwarden CI/CD
+
+on:
+  push:
+    paths:
+      - "stacks/vaultwarden/**"
+      - "scripts/deploy-vaultwarden.sh"
+      - ".gitea/workflows/vaultwarden.yml"
+
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  vaultwarden:
+    name: Validate and deploy Vaultwarden
+    runs-on: docker-home-01
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Deploy Vaultwarden
+        if: ${{ gitea.ref == 'refs/heads/main' }}
+        run: |
+          ./scripts/deploy-vaultwarden.sh
diff --git a/scripts/deploy-vaultwarden.sh b/scripts/deploy-vaultwarden.sh
new file mode 100755
index 0000000..81b229d
--- /dev/null
+++ b/scripts/deploy-vaultwarden.sh
@@ -0,0 +1,206 @@
+#!/usr/bin/env bash
+
+set -Eeuo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+
+SRC="${ROOT}/stacks/vaultwarden"
+LIVE="/srv/nfs/infra/vaultwarden"
+ENV_FILE="${LIVE}/.env"
+
+BACKUP_ROOT="/srv/nfs/infra/.deploy-backups/vaultwarden"
+STAMP="$(date '+%Y%m%d-%H%M%S')"
+BACKUP="${BACKUP_ROOT}/${STAMP}"
+
+echo "================================="
+echo " Vaultwarden deployment"
+echo "================================="
+
+echo "Source: ${SRC}"
+echo "Target: ${LIVE}"
+
+#
+# Проверки исходных файлов
+#
+
+if [[ ! -f "${SRC}/docker-compose.yml" ]]; then
+    echo "ERROR: ${SRC}/docker-compose.yml not found"
+    exit 1
+fi
+
+if [[ ! -f "${ENV_FILE}" ]]; then
+    echo "ERROR: ${ENV_FILE} not found"
+    exit 1
+fi
+
+
+#
+# Проверка docker-compose
+#
+
+echo
+echo "--- Validate Docker Compose ---"
+
+docker compose \
+    --env-file "${ENV_FILE}" \
+    -f "${SRC}/docker-compose.yml" \
+    config >/dev/null
+
+echo "Docker Compose configuration is valid."
+
+
+#
+# Определяем образ
+#
+
+echo
+echo "--- Detect Vaultwarden image ---"
+
+VAULTWARDEN_IMAGE="$(
+    docker compose \
+        --env-file "${ENV_FILE}" \
+        -f "${SRC}/docker-compose.yml" \
+        config --images |
+    grep -m1 'vaultwarden/server'
+)"
+
+if [[ -z "${VAULTWARDEN_IMAGE}" ]]; then
+    echo "ERROR: Vaultwarden image not found"
+    exit 1
+fi
+
+echo "Vaultwarden image: ${VAULTWARDEN_IMAGE}"
+
+
+#
+# Backup текущего compose
+#
+
+echo
+echo "--- Backup current configuration ---"
+
+mkdir -p "${BACKUP}"
+
+if [[ -f "${LIVE}/docker-compose.yml" ]]; then
+    cp -a \
+        "${LIVE}/docker-compose.yml" \
+        "${BACKUP}/docker-compose.yml"
+fi
+
+echo "Backup: ${BACKUP}"
+
+
+#
+# Rollback
+#
+
+rollback()
+{
+    rc=$?
+
+    echo
+    echo "!!! Deployment failed"
+
+    if [[ -f "${BACKUP}/docker-compose.yml" ]]; then
+
+        echo "Restoring previous docker-compose.yml"
+
+        cp -a \
+            "${BACKUP}/docker-compose.yml" \
+            "${LIVE}/docker-compose.yml"
+
+        (
+            cd "${LIVE}"
+
+            docker compose \
+                --env-file "${ENV_FILE}" \
+                up -d --remove-orphans || true
+        )
+    fi
+
+    exit "${rc}"
+}
+
+trap rollback ERR
+
+
+#
+# Deployment compose-файла
+#
+
+echo
+echo "--- Deploy docker-compose.yml ---"
+
+cp \
+    "${SRC}/docker-compose.yml" \
+    "${LIVE}/docker-compose.yml"
+
+
+#
+# Pull образов
+#
+
+echo
+echo "--- Pull images ---"
+
+cd "${LIVE}"
+
+docker compose \
+    --env-file "${ENV_FILE}" \
+    pull
+
+
+#
+# Apply
+#
+
+echo
+echo "--- Apply Docker Compose ---"
+
+docker compose \
+    --env-file "${ENV_FILE}" \
+    up -d --remove-orphans
+
+
+#
+# Post-check
+#
+
+echo
+echo "--- Check Vaultwarden container ---"
+
+sleep 3
+
+RUNNING="$(
+    docker inspect \
+        -f '{{.State.Running}}' \
+        vaultwarden
+)"
+
+if [[ "${RUNNING}" != "true" ]]; then
+    echo "ERROR: Vaultwarden container is not running"
+    exit 1
+fi
+
+
+#
+# Показываем фактически запущенный image
+#
+
+RUNNING_IMAGE="$(
+    docker inspect \
+        -f '{{.Config.Image}}' \
+        vaultwarden
+)"
+
+echo "Running image: ${RUNNING_IMAGE}"
+
+
+trap - ERR
+
+
+echo
+echo "================================="
+echo " Vaultwarden deployment successful"
+echo "================================="
+echo "Backup: ${BACKUP}"
diff --git a/stacks/vaultwarden/docker-compose.yml b/stacks/vaultwarden/docker-compose.yml
new file mode 100644
index 0000000..773b547
--- /dev/null
+++ b/stacks/vaultwarden/docker-compose.yml
@@ -0,0 +1,24 @@
+services:
+  vaultwarden:
+    image: vaultwarden/server:1.37.2
+    container_name: vaultwarden
+    restart: unless-stopped
+
+    env_file:
+      - .env
+
+    volumes:
+      - /srv/nfs/infra/vaultwarden/data:/data
+
+    expose:
+      - "80"
+
+    security_opt:
+      - no-new-privileges:true
+
+    networks:
+      - interdock
+
+networks:
+  interdock:
+    external: true