n0mad1k
7484a0e034
- Dual-mode operation: standalone + c2itall integrated (env var detection)
- SSH keys moved to ~/.ssh/c2deploy_ph-{id} with per-deployment known_hosts
- Ansible output streaming with filtered console + full log capture
- Deployment management menu: discover, SSH, teardown existing deployments
- Cert setup script (setup-cert.sh) deployed to servers for post-DNS LE certs
- Matrix hardening: unique secrets, SSRF protection, rate limits, nginx security headers
- Base hardening: fail2ban systemd backend (Debian 12), SSH limits, nginx jails
- Add-matrix-user helper script deployed to all Matrix servers
- .env support for standalone credential storage
- Config key rename: deploy_id → deployment_id (with backward compat)
- Provider cleanup playbooks for teardown
- Test suite with 50 tests
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
74 lines
1.8 KiB
YAML
74 lines
1.8 KiB
YAML
---
|
|
# Vaultwarden service configuration
|
|
|
|
- name: Deploy Vaultwarden environment file
|
|
copy:
|
|
dest: /opt/vaultwarden/.env
|
|
content: |
|
|
DOMAIN=https://{{ vaultwarden_domain }}
|
|
SIGNUPS_ALLOWED={{ vaultwarden_signups | lower }}
|
|
ADMIN_TOKEN={{ vaultwarden_admin_token }}
|
|
ROCKET_ADDRESS=127.0.0.1
|
|
ROCKET_PORT=8081
|
|
DATA_FOLDER=/opt/vaultwarden/data
|
|
WEB_VAULT_FOLDER=/opt/vaultwarden/web-vault
|
|
LOG_FILE=/opt/vaultwarden/data/vaultwarden.log
|
|
LOG_LEVEL=warn
|
|
SENDS_ALLOWED=true
|
|
EMERGENCY_ACCESS_ALLOWED=true
|
|
WEBSOCKET_ENABLED=true
|
|
WEBSOCKET_ADDRESS=127.0.0.1
|
|
WEBSOCKET_PORT=3012
|
|
owner: vaultwarden
|
|
group: vaultwarden
|
|
mode: "0600"
|
|
notify: restart vaultwarden
|
|
|
|
- name: Deploy Vaultwarden systemd unit
|
|
copy:
|
|
dest: /etc/systemd/system/vaultwarden.service
|
|
content: |
|
|
[Unit]
|
|
Description=Vaultwarden (Bitwarden-compatible server)
|
|
Documentation=https://github.com/dani-garcia/vaultwarden
|
|
After=network.target
|
|
|
|
[Service]
|
|
User=vaultwarden
|
|
Group=vaultwarden
|
|
EnvironmentFile=/opt/vaultwarden/.env
|
|
ExecStart=/opt/vaultwarden/vaultwarden
|
|
WorkingDirectory=/opt/vaultwarden
|
|
|
|
# Hardening
|
|
ProtectSystem=strict
|
|
ProtectHome=true
|
|
PrivateTmp=true
|
|
PrivateDevices=true
|
|
NoNewPrivileges=true
|
|
ReadWritePaths=/opt/vaultwarden/data
|
|
|
|
Restart=on-failure
|
|
RestartSec=5
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
mode: "0644"
|
|
|
|
- name: Reload systemd daemon
|
|
systemd:
|
|
daemon_reload: true
|
|
|
|
- name: Enable and start Vaultwarden
|
|
service:
|
|
name: vaultwarden
|
|
state: started
|
|
enabled: true
|
|
|
|
- name: Wait for Vaultwarden to be ready
|
|
wait_for:
|
|
port: 8081
|
|
host: 127.0.0.1
|
|
delay: 3
|
|
timeout: 30
|