v1.36.0-2: fix SELinux volume relabel, align layout with native package

- Mount /var/lib/vaultwarden/data as /data with :Z restored; podman
  refuses to relabel a volume path that equals $HOME
- Use /var/lib/vaultwarden as service HOME (rootless podman storage
  stays in .config/.local, outside the mounted data/ subdir)
- Data location matches the native vaultwarden package
  (WorkingDirectory=/var/lib/vaultwarden, relative DATA_FOLDER=data)
- Sync vaultwarden.cfg with the native 1.36.0 template
- Add Conflicts: vaultwarden (shared user, config, unit name, state dir)

vaultwarden-container.spec

@@ -1,6 +1,6 @@
 Name:           vaultwarden-container
 Version:        1.36.0
-Release:        1%{?dist}
+Release:        2%{?dist}
 Summary:        Vaultwarden - Bitwarden compatible server (container)
 License:        AGPL-3.0
 Group:          System Environment/Base
@@ -16,6 +16,8 @@ BuildRequires:  systemd-rpm-macros
 Requires:       podman
 Requires:       containers-common
 Requires:       systemd-container
+# Same user, config, unit name and data dir as the native package
+Conflicts:      vaultwarden
 
 %description
 Vaultwarden is an unofficial Bitwarden-compatible server written in Rust.
@@ -32,7 +34,11 @@ install -m 640 %{SOURCE1} %{buildroot}%{_sysconfdir}/vaultwarden/vaultwarden.cfg
 
 install -p -D -m 644 %{SOURCE3} %{buildroot}%{_sysconfdir}/containers/systemd/vaultwarden.container.d/enable.conf
 
-install -d -m 750 %{buildroot}%{_sharedstatedir}/vaultwarden-container
+# Matches the native vaultwarden layout: data in /var/lib/vaultwarden/data
+# (WorkingDirectory + relative DATA_FOLDER=data). The parent dir is HOME of
+# the quadlet service (rootless podman storage); only data/ is mounted into
+# the container, since podman refuses :Z relabeling of $HOME itself.
+install -d -m 750 %{buildroot}%{_sharedstatedir}/vaultwarden/data
 
 %pre
 %sysusers_create_package vaultwarden %{SOURCE2}
@@ -68,8 +74,17 @@ fi
 %config(noreplace) %attr(0640,root,vaultwarden) %{_sysconfdir}/vaultwarden/vaultwarden.cfg
 %dir %{_sysconfdir}/containers/systemd/vaultwarden.container.d
 %config(noreplace) %{_sysconfdir}/containers/systemd/vaultwarden.container.d/enable.conf
-%dir %attr(0750,vaultwarden,vaultwarden) %{_sharedstatedir}/vaultwarden-container
+%dir %attr(0750,vaultwarden,vaultwarden) %{_sharedstatedir}/vaultwarden
+%dir %attr(0750,vaultwarden,vaultwarden) %{_sharedstatedir}/vaultwarden/data
 
 %changelog
+* Mon Jul 13 2026 Zoran Pericic <zpericic@netst.org> - 1.36.0-2
+- Match native vaultwarden layout: data in /var/lib/vaultwarden/data
+- Use /var/lib/vaultwarden as service HOME (rootless podman storage);
+  podman refuses :Z relabeling of a volume that equals $HOME
+- Restore :Z relabel on the data volume
+- Sync vaultwarden.cfg with the native 1.36.0 template
+- Add Conflicts: vaultwarden
+
 * Tue May 06 2026 Zoran Pericic <zpericic@netst.org> - 1.36.0-1
 - Initial package