n0mad1k
3542913689
- Smart TLS: skip certbot for IPs/.local/.lan, self-signed with SAN, HSTS max-age=0 for self-signed certs, split LAN vs public messages - Dynamic PHP: versionless meta-packages, runtime detection via php_ver fact - Vaultwarden: fail-fast on armv7l (32-bit ARM not supported upstream) - Module prompts: accept IPs for matrix/cloud/vault/media, hard error on email with IP, all_in_one skips certbot email for LAN - Matrix: skip matrix. prefix strip for IPs, warn about immutable server_name - OS family guards: ansible_os_family == Debian on all apt tasks - SSH key path: expanduser().resolve() on user-provided key paths - Cloudflare Tunnel: post-deploy script (setup-tunnel.sh) using CF API token — no browser auth needed, creates tunnel + credentials + DNS + systemd Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
108 lines
2.6 KiB
YAML
108 lines
2.6 KiB
YAML
---
|
|
# Vaultwarden binary installation from GitHub releases
|
|
|
|
- name: Check for unsupported 32-bit ARM architecture
|
|
fail:
|
|
msg: "Vaultwarden does not support 32-bit ARM (armv7l). Use a 64-bit OS (aarch64) or x86_64 system."
|
|
when: ansible_architecture == "armv7l"
|
|
|
|
- name: Install prerequisites
|
|
apt:
|
|
name:
|
|
- nginx
|
|
- certbot
|
|
- python3-certbot-nginx
|
|
- libssl-dev
|
|
- pkg-config
|
|
- curl
|
|
- ca-certificates
|
|
state: present
|
|
update_cache: true
|
|
when: ansible_os_family == "Debian"
|
|
|
|
- name: Create vaultwarden system user
|
|
user:
|
|
name: vaultwarden
|
|
system: true
|
|
shell: /usr/sbin/nologin
|
|
home: /opt/vaultwarden
|
|
create_home: false
|
|
|
|
- name: Create Vaultwarden directories
|
|
file:
|
|
path: "{{ item }}"
|
|
state: directory
|
|
owner: vaultwarden
|
|
group: vaultwarden
|
|
mode: "0750"
|
|
loop:
|
|
- /opt/vaultwarden
|
|
- /opt/vaultwarden/data
|
|
|
|
- name: Detect system architecture
|
|
command: uname -m
|
|
register: system_arch
|
|
changed_when: false
|
|
|
|
- name: Set architecture for download
|
|
set_fact:
|
|
vw_arch: "{{ 'aarch64' if system_arch.stdout == 'aarch64' else 'x86_64' }}"
|
|
|
|
- name: Get latest Vaultwarden release tag
|
|
uri:
|
|
url: https://api.github.com/repos/dani-garcia/vaultwarden/releases/latest
|
|
return_content: true
|
|
headers:
|
|
Accept: application/vnd.github+json
|
|
register: vw_release
|
|
|
|
- name: Set Vaultwarden version
|
|
set_fact:
|
|
vw_version: "{{ vw_release.json.tag_name }}"
|
|
|
|
- name: Download Vaultwarden binary
|
|
get_url:
|
|
url: "https://github.com/dani-garcia/vaultwarden/releases/download/{{ vw_version }}/vaultwarden-{{ vw_version }}-linux-{{ vw_arch }}.tar.gz"
|
|
dest: "/tmp/vaultwarden-{{ vw_version }}.tar.gz"
|
|
mode: "0644"
|
|
|
|
- name: Extract Vaultwarden binary
|
|
unarchive:
|
|
src: "/tmp/vaultwarden-{{ vw_version }}.tar.gz"
|
|
dest: /opt/vaultwarden/
|
|
remote_src: true
|
|
owner: vaultwarden
|
|
group: vaultwarden
|
|
|
|
- name: Ensure binary is executable
|
|
file:
|
|
path: /opt/vaultwarden/vaultwarden
|
|
mode: "0755"
|
|
owner: vaultwarden
|
|
group: vaultwarden
|
|
|
|
- name: Download Vaultwarden web vault
|
|
get_url:
|
|
url: "https://github.com/dani-garcia/bw_web_builds/releases/latest/download/bw_web_v2024.6.2c.tar.gz"
|
|
dest: /tmp/bw_web_vault.tar.gz
|
|
mode: "0644"
|
|
failed_when: false
|
|
|
|
- name: Extract web vault
|
|
unarchive:
|
|
src: /tmp/bw_web_vault.tar.gz
|
|
dest: /opt/vaultwarden/
|
|
remote_src: true
|
|
owner: vaultwarden
|
|
group: vaultwarden
|
|
failed_when: false
|
|
|
|
- name: Allow HTTP/HTTPS through UFW
|
|
ufw:
|
|
rule: allow
|
|
port: "{{ item }}"
|
|
proto: tcp
|
|
loop:
|
|
- "80"
|
|
- "443"
|