stuff

2026-08-15 19:18:59 +02:00
parent 59aa8a7bcf
commit c63db540e8
32 changed files with 767 additions and 64 deletions
@@ -0,0 +1,101 @@
+- name: Vaultwarden
+  hosts: beepi
+  become: true
+  vars:
+    recovery_2fa: !vault |
+            $ANSIBLE_VAULT;1.1;AES256
+            33656334663834356232623236316238396630656530363332353566363433356133313932613230
+            3063613030363566376635363830336466333237633063310a666236333335363566343237646135
+            65656466363833373231653565306563333036373664316535366339393531363434386336303563
+            6636396665316634320a643966313338633564363830663263666461303635623164376265633631
+            39633162323130663533343734303538636433323632316131373531376438633432323433303234
+            3162626630373264356338356638323364656563666635393636
+
+    user: vaultwarden
+    user_home: /home/vaultwarden
+    vaultwarden_domain: vault.secretbee.buzz
+
+    # Bootstrap = -e vaultwarden_signups_allowed=true
+    vaultwarden_signups_allowed: false
+
+  tasks:
+    - name: Install dependencies
+      ansible.builtin.apt:
+        name: "{{ item }}"
+        state: present
+      loop:
+        - podman
+        - systemd-container
+        - passt
+
+    - name: Create user
+      ansible.builtin.user:
+        name: "{{ user }}"
+        home: "{{ user_home }}"
+        shell: /usr/sbin/nologin
+        create_home: true
+      register: user_info
+
+    - name: Enable linger
+      ansible.builtin.command:
+        cmd: "loginctl enable-linger {{ user }}"
+        creates: "/var/lib/systemd/linger/{{ user }}"
+
+    - name: Create quadlet directory
+      ansible.builtin.file:
+        path: "{{ user_home }}/.config/containers/systemd"
+        state: directory
+        owner: "{{ user }}"
+        group: "{{ user }}"
+        mode: '0755'
+
+    - name: Create data directory
+      ansible.builtin.file:
+        path: "{{ user_home }}/data"
+        state: directory
+        owner: "{{ user }}"
+        group: "{{ user }}"
+        mode: '0700'
+
+    - name: Deploy server quadlet
+      ansible.builtin.template:
+        src: vaultwarden.container.j2
+        dest: "{{ user_home }}/.config/containers/systemd/vaultwarden.container"
+        owner: "{{ user }}"
+        group: "{{ user }}"
+        mode: '0600'
+
+    - name: Reload user systemd
+      become: true
+      become_user: "{{ user }}"
+      environment:
+        XDG_RUNTIME_DIR: "/run/user/{{ user_info.uid }}"
+        DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ user_info.uid }}/bus"
+      ansible.builtin.systemd:
+        daemon_reload: true
+        scope: user
+
+    - name: Start user manager
+      ansible.builtin.systemd:
+        name: "user@{{ user_info.uid }}.service"
+        state: started
+
+    - name: Start vaultwarden
+      become: true
+      become_user: "{{ user }}"
+      environment:
+        XDG_RUNTIME_DIR: "/run/user/{{ user_info.uid }}"
+        DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ user_info.uid }}/bus"
+      ansible.builtin.systemd:
+        name: vaultwarden.service
+        state: restarted
+        scope: user
+
+    - name: Debug
+      ansible.builtin.debug:
+        msg:
+          - "Service status: sudo systemctl --user --machine {{ user_info.name }}@.host status vaultwarden"
+          - "Read logs: sudo journalctl _UID={{ user_info.uid }} -n 200 --no-pager"
+          - "Shell: sudo machinectl shell {{ user_info.name }}@.host /bin/bash"
+      tags:
+        - always