102 lines
3.2 KiB
YAML
102 lines
3.2 KiB
YAML
- name: Vaultwarden
|
|
hosts: beepi
|
|
become: true
|
|
vars:
|
|
recovery_2fa: !vault |
|
|
$ANSIBLE_VAULT;1.1;AES256
|
|
33656334663834356232623236316238396630656530363332353566363433356133313932613230
|
|
3063613030363566376635363830336466333237633063310a666236333335363566343237646135
|
|
65656466363833373231653565306563333036373664316535366339393531363434386336303563
|
|
6636396665316634320a643966313338633564363830663263666461303635623164376265633631
|
|
39633162323130663533343734303538636433323632316131373531376438633432323433303234
|
|
3162626630373264356338356638323364656563666635393636
|
|
|
|
user: vaultwarden
|
|
user_home: /home/vaultwarden
|
|
vaultwarden_domain: vault.secretbee.buzz
|
|
|
|
# Bootstrap = -e vaultwarden_signups_allowed=true
|
|
vaultwarden_signups_allowed: false
|
|
|
|
tasks:
|
|
- name: Install dependencies
|
|
ansible.builtin.apt:
|
|
name: "{{ item }}"
|
|
state: present
|
|
loop:
|
|
- podman
|
|
- systemd-container
|
|
- passt
|
|
|
|
- name: Create user
|
|
ansible.builtin.user:
|
|
name: "{{ user }}"
|
|
home: "{{ user_home }}"
|
|
shell: /usr/sbin/nologin
|
|
create_home: true
|
|
register: user_info
|
|
|
|
- name: Enable linger
|
|
ansible.builtin.command:
|
|
cmd: "loginctl enable-linger {{ user }}"
|
|
creates: "/var/lib/systemd/linger/{{ user }}"
|
|
|
|
- name: Create quadlet directory
|
|
ansible.builtin.file:
|
|
path: "{{ user_home }}/.config/containers/systemd"
|
|
state: directory
|
|
owner: "{{ user }}"
|
|
group: "{{ user }}"
|
|
mode: '0755'
|
|
|
|
- name: Create data directory
|
|
ansible.builtin.file:
|
|
path: "{{ user_home }}/data"
|
|
state: directory
|
|
owner: "{{ user }}"
|
|
group: "{{ user }}"
|
|
mode: '0700'
|
|
|
|
- name: Deploy server quadlet
|
|
ansible.builtin.template:
|
|
src: vaultwarden.container.j2
|
|
dest: "{{ user_home }}/.config/containers/systemd/vaultwarden.container"
|
|
owner: "{{ user }}"
|
|
group: "{{ user }}"
|
|
mode: '0600'
|
|
|
|
- name: Reload user systemd
|
|
become: true
|
|
become_user: "{{ user }}"
|
|
environment:
|
|
XDG_RUNTIME_DIR: "/run/user/{{ user_info.uid }}"
|
|
DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ user_info.uid }}/bus"
|
|
ansible.builtin.systemd:
|
|
daemon_reload: true
|
|
scope: user
|
|
|
|
- name: Start user manager
|
|
ansible.builtin.systemd:
|
|
name: "user@{{ user_info.uid }}.service"
|
|
state: started
|
|
|
|
- name: Start vaultwarden
|
|
become: true
|
|
become_user: "{{ user }}"
|
|
environment:
|
|
XDG_RUNTIME_DIR: "/run/user/{{ user_info.uid }}"
|
|
DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ user_info.uid }}/bus"
|
|
ansible.builtin.systemd:
|
|
name: vaultwarden.service
|
|
state: restarted
|
|
scope: user
|
|
|
|
- name: Debug
|
|
ansible.builtin.debug:
|
|
msg:
|
|
- "Service status: sudo systemctl --user --machine {{ user_info.name }}@.host status vaultwarden"
|
|
- "Read logs: sudo journalctl _UID={{ user_info.uid }} -n 200 --no-pager"
|
|
- "Shell: sudo machinectl shell {{ user_info.name }}@.host /bin/bash"
|
|
tags:
|
|
- always
|