0 Fork 0

T

lhahnandClaude Opus 5.5 0417ecd9a1 Add OpenID Connect SSO with optional authentik blueprint

- SSO_* settings (login only, master password still decrypts the vault)
- optional authentik blueprint: provider with authorization_code/refresh_token grants, application and an email mapping with email_verified, which vaultwarden requires to link SSO logins to existing accounts
- blueprints are copied into the authentik container, it only applies files from /blueprints

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-14 18:07:06 +02:00

defaults

Add OpenID Connect SSO with optional authentik blueprint

2026-10-14 18:07:06 +02:00

handlers

Initial vaultwarden role

2026-10-14 17:51:51 +02:00

README.md

cloud-vaultwarden

Ansible role to setup vaultwarden (Bitwarden compatible password manager) via docker compose.

listens on 127.0.0.1:<vaultwarden_http_port> only; expose it with the nginx role (TLS)
sign ups are disabled by default; invite family members from an organization instead
the admin panel is disabled unless vaultwarden_admin_token (argon2 PHC string) is set; block /admin in the public nginx site and reach it through an SSH tunnel
do NOT put a forward-auth (e.g. authentik) in front of it, the Bitwarden clients talk to the API directly
data lives in vaultwarden_data_location; back up db.sqlite3 with sqlite3 .backup, plus attachments, sends, config.json and the rsa_key* files