commit c903bc98245dd4740f5990b9c7d83d7fe6f9257a Author: mathieu Date: Sun May 24 17:13:37 2026 +0200 feat: initial installation role for vaultwarden diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..a8b42eb --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +*.retry diff --git a/README.md b/README.md new file mode 100644 index 0000000..d4e0aaa --- /dev/null +++ b/README.md @@ -0,0 +1,43 @@ +# ansible-role-vaultwarden + +Builds Vaultwarden from source using Rust and installs the binary alongside +the web vault UI (from dani-garcia/bw_web_builds). Sets up a systemd service. + +Build time is significant (10-20 minutes depending on hardware). The role +is idempotent: it only rebuilds when the target version changes. + +The service user and group must be created beforehand. + +## Requirements + +- Ansible >= 2.14 +- Debian or Ubuntu +- Internet access (downloads Rust toolchain, source code, web vault) + +## Role Variables + +| Variable | Default | Description | +|---|---|---| +| `vaultwarden_version` | `""` | Version tag to build (empty = latest) | +| `vaultwarden_user` | `vaultwarden` | User to run Vaultwarden | +| `vaultwarden_group` | `vaultwarden` | Group to run Vaultwarden | +| `vaultwarden_install_dir` | `/opt/vaultwarden` | Binary installation directory | +| `vaultwarden_data_dir` | `/var/lib/vaultwarden` | Data directory (SQLite DB, attachments) | +| `vaultwarden_webvault_dir` | `/opt/vaultwarden/web-vault` | Web vault static files | +| `vaultwarden_service_enabled` | `true` | Enable service at boot | +| `vaultwarden_service_state` | `started` | Service state after installation | + +## Example Playbook + +```yaml +- hosts: servers + roles: + - role: ansible-role-vaultwarden + vars: + vaultwarden_user: vaultwarden + vaultwarden_group: vaultwarden +``` + +## License + +MIT diff --git a/defaults/main.yml b/defaults/main.yml new file mode 100644 index 0000000..7bf1ad3 --- /dev/null +++ b/defaults/main.yml @@ -0,0 +1,9 @@ +--- +vaultwarden_version: "" +vaultwarden_user: vaultwarden +vaultwarden_group: vaultwarden +vaultwarden_install_dir: /opt/vaultwarden +vaultwarden_data_dir: /var/lib/vaultwarden +vaultwarden_webvault_dir: /opt/vaultwarden/web-vault +vaultwarden_service_enabled: true +vaultwarden_service_state: started diff --git a/handlers/main.yml b/handlers/main.yml new file mode 100644 index 0000000..ed97d53 --- /dev/null +++ b/handlers/main.yml @@ -0,0 +1 @@ +--- diff --git a/meta/main.yml b/meta/main.yml new file mode 100644 index 0000000..52e50f9 --- /dev/null +++ b/meta/main.yml @@ -0,0 +1,13 @@ +--- +galaxy_info: + author: mathieu + description: Build and install Vaultwarden from source on Linux + license: MIT + min_ansible_version: "2.14" + platforms: + - name: Debian + versions: [bullseye, bookworm] + - name: Ubuntu + versions: [focal, jammy, noble] + galaxy_tags: [vaultwarden, bitwarden, passwords] +dependencies: [] diff --git a/tasks/main.yml b/tasks/main.yml new file mode 100644 index 0000000..605237b --- /dev/null +++ b/tasks/main.yml @@ -0,0 +1,221 @@ +--- +- name: Assert Debian-based distribution + ansible.builtin.assert: + that: + - ansible_os_family == 'Debian' + fail_msg: "ansible-role-vaultwarden only supports Debian-based distributions" + +- name: Install build dependencies + ansible.builtin.apt: + name: + - build-essential + - curl + - pkg-config + - libssl-dev + - libsqlite3-dev + state: present + update_cache: true + become: true + +- name: Install Rust toolchain via rustup + ansible.builtin.shell: + cmd: curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --no-modify-path + creates: /root/.cargo/bin/cargo + become: true + +- name: Get Vaultwarden release info from GitHub + ansible.builtin.uri: + url: >- + {{ 'https://api.github.com/repos/dani-garcia/vaultwarden/releases/latest' + if vaultwarden_version == '' + else 'https://api.github.com/repos/dani-garcia/vaultwarden/releases/tags/' + vaultwarden_version }} + headers: + Accept: "application/vnd.github.v3+json" + return_content: true + register: _vaultwarden_release + +- name: Set Vaultwarden version tag fact + ansible.builtin.set_fact: + _vaultwarden_version_tag: "{{ _vaultwarden_release.json.tag_name }}" + +- name: Read installed version + ansible.builtin.slurp: + src: "{{ vaultwarden_install_dir }}/.version" + register: _vaultwarden_installed_raw + ignore_errors: true + become: true + +- name: Set installed version fact + ansible.builtin.set_fact: + _vaultwarden_installed_version: >- + {{ (_vaultwarden_installed_raw.content | b64decode | trim) + if _vaultwarden_installed_raw is not failed else '' }} + +- name: Build and install Vaultwarden + when: _vaultwarden_installed_version != _vaultwarden_version_tag + block: + - name: Download Vaultwarden source archive + ansible.builtin.get_url: + url: "https://github.com/dani-garcia/vaultwarden/archive/refs/tags/{{ _vaultwarden_version_tag }}.tar.gz" + dest: /tmp/vaultwarden-src.tar.gz + mode: '0644' + + - name: Create build directory + ansible.builtin.file: + path: /tmp/vaultwarden-build + state: directory + mode: '0755' + + - name: Extract Vaultwarden source + ansible.builtin.unarchive: + src: /tmp/vaultwarden-src.tar.gz + dest: /tmp/vaultwarden-build + remote_src: true + extra_opts: [--strip-components=1] + + - name: Build Vaultwarden binary + ansible.builtin.command: + cmd: /root/.cargo/bin/cargo build --release --features sqlite + chdir: /tmp/vaultwarden-build + become: true + + - name: Create Vaultwarden installation directory + ansible.builtin.file: + path: "{{ vaultwarden_install_dir }}" + state: directory + owner: "{{ vaultwarden_user }}" + group: "{{ vaultwarden_group }}" + mode: '0755' + become: true + + - name: Install Vaultwarden binary + ansible.builtin.copy: + src: /tmp/vaultwarden-build/target/release/vaultwarden + dest: "{{ vaultwarden_install_dir }}/vaultwarden" + remote_src: true + owner: "{{ vaultwarden_user }}" + group: "{{ vaultwarden_group }}" + mode: '0755' + become: true + + - name: Write installed version file + ansible.builtin.copy: + content: "{{ _vaultwarden_version_tag }}" + dest: "{{ vaultwarden_install_dir }}/.version" + owner: "{{ vaultwarden_user }}" + group: "{{ vaultwarden_group }}" + mode: '0644' + become: true + + - name: Clean up build artifacts + ansible.builtin.file: + path: "{{ item }}" + state: absent + loop: + - /tmp/vaultwarden-src.tar.gz + - /tmp/vaultwarden-build + +- name: Get latest web vault release info + ansible.builtin.uri: + url: https://api.github.com/repos/dani-garcia/bw_web_builds/releases/latest + headers: + Accept: "application/vnd.github.v3+json" + return_content: true + register: _webvault_release + +- name: Set web vault download URL + ansible.builtin.set_fact: + _webvault_download_url: >- + {{ _webvault_release.json.assets + | selectattr('name', 'search', 'bw_web_.*\\.tar\\.gz') + | map(attribute='browser_download_url') + | first }} + +- name: Read installed web vault version + ansible.builtin.slurp: + src: "{{ vaultwarden_webvault_dir }}/.version" + register: _webvault_installed_raw + ignore_errors: true + become: true + +- name: Install or upgrade web vault + when: >- + (_webvault_installed_raw is failed) + or (_webvault_installed_raw.content | b64decode | trim) != _webvault_release.json.tag_name + block: + - name: Download web vault archive + ansible.builtin.get_url: + url: "{{ _webvault_download_url }}" + dest: /tmp/web-vault.tar.gz + mode: '0644' + + - name: Create web vault directory + ansible.builtin.file: + path: "{{ vaultwarden_webvault_dir }}" + state: directory + owner: "{{ vaultwarden_user }}" + group: "{{ vaultwarden_group }}" + mode: '0755' + become: true + + - name: Extract web vault + ansible.builtin.unarchive: + src: /tmp/web-vault.tar.gz + dest: "{{ vaultwarden_install_dir }}" + remote_src: true + owner: "{{ vaultwarden_user }}" + group: "{{ vaultwarden_group }}" + become: true + + - name: Write web vault version file + ansible.builtin.copy: + content: "{{ _webvault_release.json.tag_name }}" + dest: "{{ vaultwarden_webvault_dir }}/.version" + owner: "{{ vaultwarden_user }}" + group: "{{ vaultwarden_group }}" + mode: '0644' + become: true + + - name: Remove web vault archive + ansible.builtin.file: + path: /tmp/web-vault.tar.gz + state: absent + +- name: Create Vaultwarden data directory + ansible.builtin.file: + path: "{{ vaultwarden_data_dir }}" + state: directory + owner: "{{ vaultwarden_user }}" + group: "{{ vaultwarden_group }}" + mode: '0750' + become: true + +- name: Create Vaultwarden systemd service + ansible.builtin.copy: + content: | + [Unit] + Description=Vaultwarden Password Manager + After=network.target + + [Service] + User={{ vaultwarden_user }} + Group={{ vaultwarden_group }} + Environment=DATA_FOLDER={{ vaultwarden_data_dir }} + Environment=WEB_VAULT_FOLDER={{ vaultwarden_webvault_dir }} + ExecStart={{ vaultwarden_install_dir }}/vaultwarden + Restart=on-failure + RestartSec=5s + + [Install] + WantedBy=multi-user.target + dest: /etc/systemd/system/vaultwarden.service + mode: '0644' + become: true + +- name: Enable and start Vaultwarden service + ansible.builtin.systemd: + name: vaultwarden + enabled: "{{ vaultwarden_service_enabled }}" + state: "{{ vaultwarden_service_state }}" + daemon_reload: true + become: true