lhahnandClaude Opus 5.5
0417ecd9a1
- SSO_* settings (login only, master password still decrypts the vault) - optional authentik blueprint: provider with authorization_code/refresh_token grants, application and an email mapping with email_verified, which vaultwarden requires to link SSO logins to existing accounts - blueprints are copied into the authentik container, it only applies files from /blueprints Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
64 lines
1.8 KiB
YAML
64 lines
1.8 KiB
YAML
---
|
|
- name: install vaultwarden recommendations
|
|
apt:
|
|
update_cache: yes
|
|
state: "{% if cloud_update | bool %}latest{% else %}present{% endif %}"
|
|
install_recommends: yes
|
|
pkg:
|
|
- "sqlite3"
|
|
|
|
- name: setup vaultwarden directories
|
|
file:
|
|
state: directory
|
|
path: "{{ item }}"
|
|
owner: root
|
|
group: root
|
|
mode: 0750
|
|
loop:
|
|
- "{{ vaultwarden_dir }}"
|
|
- "{{ vaultwarden_inst }}"
|
|
- "{{ vaultwarden_data_location }}"
|
|
|
|
- name: template vaultwarden compose file
|
|
template:
|
|
src: opt/vaultwarden/docker-compose.yml.j2
|
|
dest: "{{ vaultwarden_inst }}/docker-compose.yml"
|
|
mode: 0644
|
|
owner: root
|
|
group: root
|
|
notify: restart vaultwarden
|
|
|
|
- name: template vaultwarden environment
|
|
template:
|
|
src: opt/vaultwarden/.env.j2
|
|
dest: "{{ vaultwarden_inst }}/.env"
|
|
mode: 0640
|
|
owner: root
|
|
group: root
|
|
notify: restart vaultwarden
|
|
|
|
- name: start vaultwarden
|
|
community.docker.docker_compose_v2:
|
|
project_src: "{{ vaultwarden_inst }}"
|
|
state: present
|
|
|
|
- name: setup authentik blueprint for vaultwarden sso
|
|
template:
|
|
src: opt/authentik/vaultwarden-sso.yaml.j2
|
|
dest: "{{ vaultwarden_sso_authentik_data }}/vaultwarden-sso.yaml"
|
|
mode: 0600
|
|
owner: "1000"
|
|
group: "1000"
|
|
register: vaultwarden_sso_blueprint
|
|
when: vaultwarden_sso_enabled | bool and vaultwarden_sso_authentik | bool
|
|
|
|
# authentik only applies blueprints from its own blueprints folder
|
|
- name: apply authentik blueprint for vaultwarden sso
|
|
command:
|
|
cmd: "{{ item }}"
|
|
loop:
|
|
- "docker cp {{ vaultwarden_sso_authentik_data }}/vaultwarden-sso.yaml {{ vaultwarden_sso_authentik_container }}:/blueprints/custom-vaultwarden-sso.yaml"
|
|
- "docker exec {{ vaultwarden_sso_authentik_container }} ak apply_blueprint custom-vaultwarden-sso.yaml"
|
|
no_log: true
|
|
when: vaultwarden_sso_blueprint is changed
|