untested: added ansible

README.md

@@ -0,0 +1 @@
+# vaultwarden

compose.yml

@@ -1,36 +0,0 @@
----
-
-services:
-  vaultwarden:
-    image: vaultwarden/server:1.35.2
-    environment:
-      - DOMAIN="https://vaultwarden.urmel.de"
-      - ADMIN_TOKEN=${ADMIN_TOKEN}
-    volumes:
-      - data:/data
-    networks:
-      - proxy    
-    restart: unless-stopped
-    labels:
-      traefik.enable: true
-      traefik.http.routers.vaultwarden.rule: "Host(`vaultwarden.urmel.de`)"
-      traefik.http.routers.vaultwarden.tls: true
-      traefik.http.routers.vaultwarden.priority: 100
-      traefik.http.routers.vaultwarden.tls.certResolver: hetzner
-      traefik.http.services.vaultwarden-https.loadbalancer.server.port: 80
-    
-      traefik.http.routers.vaultwarden-admin.rule: "Host(`vaultwarden.urmel.de`) && PathPrefix(`/admin`)"
-      traefik.http.routers.vaultwarden-admin.middlewares: secure-only@file
-      traefik.http.routers.vaultwarden-admin.priority: 200
-      traefik.http.routers.vaultwarden-admin.tls: true
-      traefik.http.routers.vaultwarden-admin.service: vaultwarden-https
-
-
-volumes:
-  data:
-    name: vaultwarden_data
-
-networks:
-  proxy:
-    name: traefik_exposed
-    external: true

defaults/main.yml

@@ -0,0 +1,17 @@
+path: /srv/{{ role_name }}
+
+vaultwarden_override: {}
+vaultwarden_defaults:
+  url: ""
+  admin_token: ""
+  org_name: "Urmel Sevices"
+  oidc:
+    issuer: ""
+    client_id: ""
+    client_secret: ""
+
+  mail:
+    host: ""
+    port: 587
+    user: ""
+    password: ""

handlers/main.yml

@@ -0,0 +1,9 @@
+- name: restart container
+community.docker.docker_compose_v2:
+    project_src: "{{ path }}"
+    project_name: "{{ role_name }}"
+    recreate: "always"
+    services: ["vaultwarden"]
+    state: "restarted"
+when: not _vaultwarden_already_restarted
+

meta/main.yml

@@ -0,0 +1,20 @@
+---
+galaxy_info:
+  author: "Niklas Freese <niklas@urmel.de>"
+  description: vaultwarden
+  company: "Urmel Services"
+  license: AGPL-3.0-or-later
+  min_ansible_version: 2.1
+  # If this a Container Enabled role, provide the minimum Ansible Container version.
+  # min_ansible_container_version:
+
+  galaxy_tags: []
+    # List tags for your role here, one per line. A tag is a keyword that describes
+    # and categorizes the role. Users find roles by searching for tags. Be sure to
+    # remove the '[]' above, if you add tags to this list.
+    #
+    # NOTE: A tag is limited to a single word comprised of alphanumeric characters.
+    #       Maximum 20 tags per role.
+
+# dependencies:
+#  - role: base

tasks/main.yml

@@ -0,0 +1,37 @@
+---
+- name: "set local variables from overrides and defaults"
+  set_fact:
+    vaultwarden: "{{ (vaultwarden_defaults | combine(vaultwarden_override, recursive=True)) if vaultwarden_override else vaultwarden_defaults }}"
+
+- name: ensure that path exists
+  file:
+    path: "{{ path }}/config/vaultwarden"
+    state: directory
+
+- name: install argon2 util for generating admin_token_hash
+  apt:
+    name: argon2
+
+- name: set admin_token hash
+  shell:
+    cmd: "argon2 {{ lookup('ansible.builtin.password', '/dev/null', seed=inventory_hostname) }} -e -id -k 19456 -t 2 -p 1"
+    stdin: "{{ vaultwarden.admin_token }}"
+    stdin_add_newline: false
+  register: vaultwarden_admin_token_hash
+
+- name: template docker-compose
+  template:
+    src: compose.yaml.j2
+    dest: "{{ path }}/compose.yaml"
+  notify: restart container
+
+
+- name: ensure containers are running
+  community.docker.docker_compose_v2:
+    project_src: "{{ path }}"
+    project_name: "{{ role_name }}"
+    state: "present"
+    pull: "always"
+    wait: true
+    services: [ 'vaultwarden' ]
+  register: _compose_result

templates/compose.yml.j2

@@ -0,0 +1,51 @@
+---
+
+services:
+  vaultwarden:
+    image: vaultwarden/server:1.35.2
+    environment:
+      DOMAIN: "https://{{ vaultwarden.url }}"
+      ADMIN_TOKEN: "{{ vaultwarden_admin_token_hash.stdout | replace('$', '$$') }}"
+
+      {% if vaultwarden.oidc.enabled -%}
+      SSO_ENABLED: "true"
+      SSO_PKCE: "true"
+      SSO_AUTHORITY: "{{ vaultwarden.oidc.issuer }}"
+      SSO_CLIENT_ID: "{{ vaultwarden.oidc.client_id }}"
+      SSO_CLIENT_SECRET: "{{ vaultwarden.oidc.client_secret }}"
+
+      {% endif -%}
+
+      {% if vaultwarden.mail.host | length >= 1 -%}
+      SMTP_HOST: "{{ vaultwarden.mail.host }}"
+      SMTP_FROM: "{{ vaultwarden.mail.user }}"
+      SMTP_FROM_NAME: "{{ vaultwarden.org_name }}"
+      SMTP_SECURITY: "starttls"
+      SMTP_PORT: "587"
+      SMTP_USERNAME: "{{ vaultwarden.mail.user }}"
+      SMTP_PASSWORD: "{{ vaultwarden.mail.password }}"
+      {% endif -%}
+      IP_HEADER: "X-Forwarded-For"
+    volumes:
+      - ./data/vaultwarden:/data
+    networks:
+      - proxy
+    restart: unless-stopped
+    labels:
+      traefik.enable: true
+      traefik.http.routers.vaultwarden.rule: "Host(`{{ vaultwarden.url }}`)"
+      traefik.http.routers.vaultwarden.tls: true
+      traefik.http.routers.vaultwarden.priority: 100
+      traefik.http.routers.vaultwarden.tls.certResolver: hetzner
+      traefik.http.services.vaultwarden-https.loadbalancer.server.port: 80
+
+      traefik.http.routers.vaultwarden-admin.rule: "Host(`{{ vaultwarden.url }}`) && PathPrefix(`/admin`)"
+      traefik.http.routers.vaultwarden-admin.middlewares: secure-only@file
+      traefik.http.routers.vaultwarden-admin.priority: 200
+      traefik.http.routers.vaultwarden-admin.tls: true
+      traefik.http.routers.vaultwarden-admin.service: vaultwarden-https
+
+networks:
+  proxy:
+    name: traefik_exposed
+    external: true