From 9f99afef8ee65f49f3208d139c7fb7b5bc768dff Mon Sep 17 00:00:00 2001 From: Kyattsukuro Date: Sun, 27 Sep 2026 15:47:05 +0200 Subject: [PATCH] untested: added ansible --- README.md | 1 + compose.yml | 36 ---------------------------- defaults/main.yml | 17 ++++++++++++++ handlers/main.yml | 9 +++++++ meta/main.yml | 20 ++++++++++++++++ tasks/main.yml | 37 +++++++++++++++++++++++++++++ templates/compose.yml.j2 | 51 ++++++++++++++++++++++++++++++++++++++++ 7 files changed, 135 insertions(+), 36 deletions(-) create mode 100644 README.md delete mode 100644 compose.yml create mode 100644 defaults/main.yml create mode 100644 handlers/main.yml create mode 100644 meta/main.yml create mode 100644 tasks/main.yml create mode 100644 templates/compose.yml.j2 diff --git a/README.md b/README.md new file mode 100644 index 0000000..ee92e02 --- /dev/null +++ b/README.md @@ -0,0 +1 @@ +# vaultwarden diff --git a/compose.yml b/compose.yml deleted file mode 100644 index 402bcd7..0000000 --- a/compose.yml +++ /dev/null @@ -1,36 +0,0 @@ ---- - -services: - vaultwarden: - image: vaultwarden/server:1.35.2 - environment: - - DOMAIN="https://vaultwarden.urmel.de" - - ADMIN_TOKEN=${ADMIN_TOKEN} - volumes: - - data:/data - networks: - - proxy - restart: unless-stopped - labels: - traefik.enable: true - traefik.http.routers.vaultwarden.rule: "Host(`vaultwarden.urmel.de`)" - traefik.http.routers.vaultwarden.tls: true - traefik.http.routers.vaultwarden.priority: 100 - traefik.http.routers.vaultwarden.tls.certResolver: hetzner - traefik.http.services.vaultwarden-https.loadbalancer.server.port: 80 - - traefik.http.routers.vaultwarden-admin.rule: "Host(`vaultwarden.urmel.de`) && PathPrefix(`/admin`)" - traefik.http.routers.vaultwarden-admin.middlewares: secure-only@file - traefik.http.routers.vaultwarden-admin.priority: 200 - traefik.http.routers.vaultwarden-admin.tls: true - traefik.http.routers.vaultwarden-admin.service: vaultwarden-https - - -volumes: - data: - name: vaultwarden_data - -networks: - proxy: - name: traefik_exposed - external: true \ No newline at end of file diff --git a/defaults/main.yml b/defaults/main.yml new file mode 100644 index 0000000..42d691e --- /dev/null +++ b/defaults/main.yml @@ -0,0 +1,17 @@ +path: /srv/{{ role_name }} + +vaultwarden_override: {} +vaultwarden_defaults: + url: "" + admin_token: "" + org_name: "Urmel Sevices" + oidc: + issuer: "" + client_id: "" + client_secret: "" + + mail: + host: "" + port: 587 + user: "" + password: "" diff --git a/handlers/main.yml b/handlers/main.yml new file mode 100644 index 0000000..6fd3d12 --- /dev/null +++ b/handlers/main.yml @@ -0,0 +1,9 @@ +- name: restart container +community.docker.docker_compose_v2: + project_src: "{{ path }}" + project_name: "{{ role_name }}" + recreate: "always" + services: ["vaultwarden"] + state: "restarted" +when: not _vaultwarden_already_restarted + diff --git a/meta/main.yml b/meta/main.yml new file mode 100644 index 0000000..3384676 --- /dev/null +++ b/meta/main.yml @@ -0,0 +1,20 @@ +--- +galaxy_info: + author: "Niklas Freese " + description: vaultwarden + company: "Urmel Services" + license: AGPL-3.0-or-later + min_ansible_version: 2.1 + # If this a Container Enabled role, provide the minimum Ansible Container version. + # min_ansible_container_version: + + galaxy_tags: [] + # List tags for your role here, one per line. A tag is a keyword that describes + # and categorizes the role. Users find roles by searching for tags. Be sure to + # remove the '[]' above, if you add tags to this list. + # + # NOTE: A tag is limited to a single word comprised of alphanumeric characters. + # Maximum 20 tags per role. + +# dependencies: +# - role: base diff --git a/tasks/main.yml b/tasks/main.yml new file mode 100644 index 0000000..97a0bbf --- /dev/null +++ b/tasks/main.yml @@ -0,0 +1,37 @@ +--- +- name: "set local variables from overrides and defaults" + set_fact: + vaultwarden: "{{ (vaultwarden_defaults | combine(vaultwarden_override, recursive=True)) if vaultwarden_override else vaultwarden_defaults }}" + +- name: ensure that path exists + file: + path: "{{ path }}/config/vaultwarden" + state: directory + +- name: install argon2 util for generating admin_token_hash + apt: + name: argon2 + +- name: set admin_token hash + shell: + cmd: "argon2 {{ lookup('ansible.builtin.password', '/dev/null', seed=inventory_hostname) }} -e -id -k 19456 -t 2 -p 1" + stdin: "{{ vaultwarden.admin_token }}" + stdin_add_newline: false + register: vaultwarden_admin_token_hash + +- name: template docker-compose + template: + src: compose.yaml.j2 + dest: "{{ path }}/compose.yaml" + notify: restart container + + +- name: ensure containers are running + community.docker.docker_compose_v2: + project_src: "{{ path }}" + project_name: "{{ role_name }}" + state: "present" + pull: "always" + wait: true + services: [ 'vaultwarden' ] + register: _compose_result diff --git a/templates/compose.yml.j2 b/templates/compose.yml.j2 new file mode 100644 index 0000000..2f61afe --- /dev/null +++ b/templates/compose.yml.j2 @@ -0,0 +1,51 @@ +--- + +services: + vaultwarden: + image: vaultwarden/server:1.35.2 + environment: + DOMAIN: "https://{{ vaultwarden.url }}" + ADMIN_TOKEN: "{{ vaultwarden_admin_token_hash.stdout | replace('$', '$$') }}" + + {% if vaultwarden.oidc.enabled -%} + SSO_ENABLED: "true" + SSO_PKCE: "true" + SSO_AUTHORITY: "{{ vaultwarden.oidc.issuer }}" + SSO_CLIENT_ID: "{{ vaultwarden.oidc.client_id }}" + SSO_CLIENT_SECRET: "{{ vaultwarden.oidc.client_secret }}" + + {% endif -%} + + {% if vaultwarden.mail.host | length >= 1 -%} + SMTP_HOST: "{{ vaultwarden.mail.host }}" + SMTP_FROM: "{{ vaultwarden.mail.user }}" + SMTP_FROM_NAME: "{{ vaultwarden.org_name }}" + SMTP_SECURITY: "starttls" + SMTP_PORT: "587" + SMTP_USERNAME: "{{ vaultwarden.mail.user }}" + SMTP_PASSWORD: "{{ vaultwarden.mail.password }}" + {% endif -%} + IP_HEADER: "X-Forwarded-For" + volumes: + - ./data/vaultwarden:/data + networks: + - proxy + restart: unless-stopped + labels: + traefik.enable: true + traefik.http.routers.vaultwarden.rule: "Host(`{{ vaultwarden.url }}`)" + traefik.http.routers.vaultwarden.tls: true + traefik.http.routers.vaultwarden.priority: 100 + traefik.http.routers.vaultwarden.tls.certResolver: hetzner + traefik.http.services.vaultwarden-https.loadbalancer.server.port: 80 + + traefik.http.routers.vaultwarden-admin.rule: "Host(`{{ vaultwarden.url }}`) && PathPrefix(`/admin`)" + traefik.http.routers.vaultwarden-admin.middlewares: secure-only@file + traefik.http.routers.vaultwarden-admin.priority: 200 + traefik.http.routers.vaultwarden-admin.tls: true + traefik.http.routers.vaultwarden-admin.service: vaultwarden-https + +networks: + proxy: + name: traefik_exposed + external: true