vaultwarden

Vaultwarden

UNMAINTAINED

This role is unmaintained, since I no longer use it. (Switched to different toolsets completeley).

I suggest you use https://github.com/JensTimmerman/ansible-role-vaultwarden/ instead!

IMPORTANT: This role was previously known as `dmaes.bitwardenrs`

Since the Bitwarden_RS project changed names to Vaultwarden, so did this role (see #12 for more info). Force this change, we changed everything from bitwardenrs to vaultwarden (variables used in the ansible code, but also directories, user, systemd service, etc.) When making the switch:

Stop old bitwarden_rs service
Make a backup of both files and database for good measure
Update your ansible code to work with new role
Either point vaultwarden_directory to the old directory, or move stuff to the new default (/opt/vaultwarden). Also pay attention to vaultwarden_datadir if using a custom one.
The new vaultwarden user should get the same rights on the database as your previous bitwardenrs user
- for postgres:
  - su - postgres
  - psql
  - postgres-# GRANT bitwardenrs TO vaultwarden;
Run ansible, this will create everything under the new name (user and service, not directory)
Cleanup old user, service (and possibly (data)directory)

Builds, installs and configures Vaultwarden (without Docker).

Only tested on Debian 10 and CentOS 8

Requirements

Requirements for the unarchive-module
Requirements for the package-module
wget or curl
jinja => v2.11
Systemd (optional)

Role Variables

Variable	Description	Default value
`vaultwarden_directory`	Where to install Vaultwarden	`/opt/vaultwarden`
`vaultwarden_version`	Which version to install	`1.17.0`
`vaultwarden_webvault`	Install the patched webvault	`true`
`vaultwarden_webvault_version`	Version of the webvault to install	`2.16.1`
`vaultwarden_build_backend`	The database-type to compile for	vaultwarden_version-specific()*
`vaultwarden_force_recompile`	Force recompile binary, (e.g. you switched backends on same server	`false`
`vaultwarden_config`	Key-value environment variables for the Vaultwarden `.env` file	`{ DOMAIN: "https://{{ ansible_fqdn }}/" }`
`vaultwarden_datadir`	Vaultwarden data directory (does not configure, only create and used for e.g. keys)	`{{ vaultwarden_directory }}/data`
`vaultwarden_encryption_key`	RSA key to use for encryption (content, not file), empty string to not copy, Vaultwarden should generate one if non-existing	`""`
`vaultwarden_force_encryption_key`	Force changing encryption key if it already exists (DANGEROUS!)	`false`
`vaultwarden_systemd`	Manage systemd service	`{{ ansible_service_mgr == 'systemd' }}`
()Starting from `vaultwarden_version: 1.17.0`: defaults to `sqlite,mysql,postgresql`, before: defaults to `sqlite`*

Example Playbook

- hosts: servers
  vars:
    vaultwarden_configure: yes
    vaultwarden_port: "443"
    vaultwarden_build_backend: "sqlite,postgresql"
    admin_token: !vault | 
      $ANSIBLE_VAULT;1.1;AES256
      ...
    vaultwarden_config:
      DOMAIN: "https://example.com/"
      DOMAIN_PATH: "/vaultwarden"  # results in a domain of https://example.com/vaultwarden/, needs to start with a '/'
      ADMIN_TOKEN: "{{ admin_token }}"
      DATABASE_URL: "postgresql:///vaultwarden?host=/run/postgresql/"
      SIGNUPS_ALLOWED: 'false'
      SIGNUPS_VERIFY: 'true'
      SIGNUPS_DOMAINS_WHITELIST: 'example.com'
      INVITATIONS_ALLOWED: 'true'
      SMTP_HOST: 'mail.example.com'
      SMTP_FROM: '[email protected]'
      SMTP_FROM_NAME: 'vaultwarden'
  roles:
    - dmaes.vaultwarden