cloud-vaultwarden

Ansible role to setup vaultwarden (Bitwarden compatible password manager) via docker compose.

• listens on 127.0.0.1:<vaultwarden_http_port> only; expose it with the nginx role (TLS)
• sign ups are disabled by default; invite family members from an organization instead
• the admin panel is disabled unless vaultwarden_admin_token (argon2 PHC string) is set; block /admin in the public nginx site and reach it through an SSH tunnel
• do NOT put a forward-auth (e.g. authentik) in front of it, the Bitwarden clients talk to the API directly
• data lives in vaultwarden_data_location; back up db.sqlite3 with sqlite3 .backup, plus attachments, sends, config.json and the rsa_key* files