66 lines
1.9 KiB
YAML
66 lines
1.9 KiB
YAML
---
|
|
- name: install vaultwarden recommendations
|
|
apt:
|
|
update_cache: yes
|
|
state: "{% if cloud_update | bool %}latest{% else %}present{% endif %}"
|
|
install_recommends: yes
|
|
pkg:
|
|
- "sqlite3"
|
|
# hash an admin token: echo -n "$TOKEN" | argon2 "$(openssl rand -base64 32)" -e -id -k 65540 -t 3 -p 4
|
|
- "argon2"
|
|
|
|
- name: setup vaultwarden directories
|
|
file:
|
|
state: directory
|
|
path: "{{ item }}"
|
|
owner: root
|
|
group: root
|
|
mode: 0750
|
|
loop:
|
|
- "{{ vaultwarden_dir }}"
|
|
- "{{ vaultwarden_inst }}"
|
|
- "{{ vaultwarden_data_location }}"
|
|
|
|
- name: template vaultwarden compose file
|
|
template:
|
|
src: opt/vaultwarden/docker-compose.yml.j2
|
|
dest: "{{ vaultwarden_inst }}/docker-compose.yml"
|
|
mode: 0644
|
|
owner: root
|
|
group: root
|
|
notify: restart vaultwarden
|
|
|
|
- name: template vaultwarden environment
|
|
template:
|
|
src: opt/vaultwarden/.env.j2
|
|
dest: "{{ vaultwarden_inst }}/.env"
|
|
mode: 0640
|
|
owner: root
|
|
group: root
|
|
notify: restart vaultwarden
|
|
|
|
- name: start vaultwarden
|
|
community.docker.docker_compose_v2:
|
|
project_src: "{{ vaultwarden_inst }}"
|
|
state: present
|
|
|
|
- name: setup authentik blueprint for vaultwarden sso
|
|
template:
|
|
src: opt/authentik/vaultwarden-sso.yaml.j2
|
|
dest: "{{ vaultwarden_sso_authentik_data }}/vaultwarden-sso.yaml"
|
|
mode: 0600
|
|
owner: "1000"
|
|
group: "1000"
|
|
register: vaultwarden_sso_blueprint
|
|
when: vaultwarden_sso_enabled | bool and vaultwarden_sso_authentik | bool
|
|
|
|
# authentik only applies blueprints from its own blueprints folder
|
|
- name: apply authentik blueprint for vaultwarden sso
|
|
command:
|
|
cmd: "{{ item }}"
|
|
loop:
|
|
- "docker cp {{ vaultwarden_sso_authentik_data }}/vaultwarden-sso.yaml {{ vaultwarden_sso_authentik_container }}:/blueprints/custom-vaultwarden-sso.yaml"
|
|
- "docker exec {{ vaultwarden_sso_authentik_container }} ak apply_blueprint custom-vaultwarden-sso.yaml"
|
|
no_log: true
|
|
when: vaultwarden_sso_blueprint is changed
|