feat: initial installation role for vaultwarden
This commit is contained in:
221
tasks/main.yml
Normal file
221
tasks/main.yml
Normal file
@@ -0,0 +1,221 @@
|
||||
---
|
||||
- name: Assert Debian-based distribution
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- ansible_os_family == 'Debian'
|
||||
fail_msg: "ansible-role-vaultwarden only supports Debian-based distributions"
|
||||
|
||||
- name: Install build dependencies
|
||||
ansible.builtin.apt:
|
||||
name:
|
||||
- build-essential
|
||||
- curl
|
||||
- pkg-config
|
||||
- libssl-dev
|
||||
- libsqlite3-dev
|
||||
state: present
|
||||
update_cache: true
|
||||
become: true
|
||||
|
||||
- name: Install Rust toolchain via rustup
|
||||
ansible.builtin.shell:
|
||||
cmd: curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --no-modify-path
|
||||
creates: /root/.cargo/bin/cargo
|
||||
become: true
|
||||
|
||||
- name: Get Vaultwarden release info from GitHub
|
||||
ansible.builtin.uri:
|
||||
url: >-
|
||||
{{ 'https://api.github.com/repos/dani-garcia/vaultwarden/releases/latest'
|
||||
if vaultwarden_version == ''
|
||||
else 'https://api.github.com/repos/dani-garcia/vaultwarden/releases/tags/' + vaultwarden_version }}
|
||||
headers:
|
||||
Accept: "application/vnd.github.v3+json"
|
||||
return_content: true
|
||||
register: _vaultwarden_release
|
||||
|
||||
- name: Set Vaultwarden version tag fact
|
||||
ansible.builtin.set_fact:
|
||||
_vaultwarden_version_tag: "{{ _vaultwarden_release.json.tag_name }}"
|
||||
|
||||
- name: Read installed version
|
||||
ansible.builtin.slurp:
|
||||
src: "{{ vaultwarden_install_dir }}/.version"
|
||||
register: _vaultwarden_installed_raw
|
||||
ignore_errors: true
|
||||
become: true
|
||||
|
||||
- name: Set installed version fact
|
||||
ansible.builtin.set_fact:
|
||||
_vaultwarden_installed_version: >-
|
||||
{{ (_vaultwarden_installed_raw.content | b64decode | trim)
|
||||
if _vaultwarden_installed_raw is not failed else '' }}
|
||||
|
||||
- name: Build and install Vaultwarden
|
||||
when: _vaultwarden_installed_version != _vaultwarden_version_tag
|
||||
block:
|
||||
- name: Download Vaultwarden source archive
|
||||
ansible.builtin.get_url:
|
||||
url: "https://github.com/dani-garcia/vaultwarden/archive/refs/tags/{{ _vaultwarden_version_tag }}.tar.gz"
|
||||
dest: /tmp/vaultwarden-src.tar.gz
|
||||
mode: '0644'
|
||||
|
||||
- name: Create build directory
|
||||
ansible.builtin.file:
|
||||
path: /tmp/vaultwarden-build
|
||||
state: directory
|
||||
mode: '0755'
|
||||
|
||||
- name: Extract Vaultwarden source
|
||||
ansible.builtin.unarchive:
|
||||
src: /tmp/vaultwarden-src.tar.gz
|
||||
dest: /tmp/vaultwarden-build
|
||||
remote_src: true
|
||||
extra_opts: [--strip-components=1]
|
||||
|
||||
- name: Build Vaultwarden binary
|
||||
ansible.builtin.command:
|
||||
cmd: /root/.cargo/bin/cargo build --release --features sqlite
|
||||
chdir: /tmp/vaultwarden-build
|
||||
become: true
|
||||
|
||||
- name: Create Vaultwarden installation directory
|
||||
ansible.builtin.file:
|
||||
path: "{{ vaultwarden_install_dir }}"
|
||||
state: directory
|
||||
owner: "{{ vaultwarden_user }}"
|
||||
group: "{{ vaultwarden_group }}"
|
||||
mode: '0755'
|
||||
become: true
|
||||
|
||||
- name: Install Vaultwarden binary
|
||||
ansible.builtin.copy:
|
||||
src: /tmp/vaultwarden-build/target/release/vaultwarden
|
||||
dest: "{{ vaultwarden_install_dir }}/vaultwarden"
|
||||
remote_src: true
|
||||
owner: "{{ vaultwarden_user }}"
|
||||
group: "{{ vaultwarden_group }}"
|
||||
mode: '0755'
|
||||
become: true
|
||||
|
||||
- name: Write installed version file
|
||||
ansible.builtin.copy:
|
||||
content: "{{ _vaultwarden_version_tag }}"
|
||||
dest: "{{ vaultwarden_install_dir }}/.version"
|
||||
owner: "{{ vaultwarden_user }}"
|
||||
group: "{{ vaultwarden_group }}"
|
||||
mode: '0644'
|
||||
become: true
|
||||
|
||||
- name: Clean up build artifacts
|
||||
ansible.builtin.file:
|
||||
path: "{{ item }}"
|
||||
state: absent
|
||||
loop:
|
||||
- /tmp/vaultwarden-src.tar.gz
|
||||
- /tmp/vaultwarden-build
|
||||
|
||||
- name: Get latest web vault release info
|
||||
ansible.builtin.uri:
|
||||
url: https://api.github.com/repos/dani-garcia/bw_web_builds/releases/latest
|
||||
headers:
|
||||
Accept: "application/vnd.github.v3+json"
|
||||
return_content: true
|
||||
register: _webvault_release
|
||||
|
||||
- name: Set web vault download URL
|
||||
ansible.builtin.set_fact:
|
||||
_webvault_download_url: >-
|
||||
{{ _webvault_release.json.assets
|
||||
| selectattr('name', 'search', 'bw_web_.*\\.tar\\.gz')
|
||||
| map(attribute='browser_download_url')
|
||||
| first }}
|
||||
|
||||
- name: Read installed web vault version
|
||||
ansible.builtin.slurp:
|
||||
src: "{{ vaultwarden_webvault_dir }}/.version"
|
||||
register: _webvault_installed_raw
|
||||
ignore_errors: true
|
||||
become: true
|
||||
|
||||
- name: Install or upgrade web vault
|
||||
when: >-
|
||||
(_webvault_installed_raw is failed)
|
||||
or (_webvault_installed_raw.content | b64decode | trim) != _webvault_release.json.tag_name
|
||||
block:
|
||||
- name: Download web vault archive
|
||||
ansible.builtin.get_url:
|
||||
url: "{{ _webvault_download_url }}"
|
||||
dest: /tmp/web-vault.tar.gz
|
||||
mode: '0644'
|
||||
|
||||
- name: Create web vault directory
|
||||
ansible.builtin.file:
|
||||
path: "{{ vaultwarden_webvault_dir }}"
|
||||
state: directory
|
||||
owner: "{{ vaultwarden_user }}"
|
||||
group: "{{ vaultwarden_group }}"
|
||||
mode: '0755'
|
||||
become: true
|
||||
|
||||
- name: Extract web vault
|
||||
ansible.builtin.unarchive:
|
||||
src: /tmp/web-vault.tar.gz
|
||||
dest: "{{ vaultwarden_install_dir }}"
|
||||
remote_src: true
|
||||
owner: "{{ vaultwarden_user }}"
|
||||
group: "{{ vaultwarden_group }}"
|
||||
become: true
|
||||
|
||||
- name: Write web vault version file
|
||||
ansible.builtin.copy:
|
||||
content: "{{ _webvault_release.json.tag_name }}"
|
||||
dest: "{{ vaultwarden_webvault_dir }}/.version"
|
||||
owner: "{{ vaultwarden_user }}"
|
||||
group: "{{ vaultwarden_group }}"
|
||||
mode: '0644'
|
||||
become: true
|
||||
|
||||
- name: Remove web vault archive
|
||||
ansible.builtin.file:
|
||||
path: /tmp/web-vault.tar.gz
|
||||
state: absent
|
||||
|
||||
- name: Create Vaultwarden data directory
|
||||
ansible.builtin.file:
|
||||
path: "{{ vaultwarden_data_dir }}"
|
||||
state: directory
|
||||
owner: "{{ vaultwarden_user }}"
|
||||
group: "{{ vaultwarden_group }}"
|
||||
mode: '0750'
|
||||
become: true
|
||||
|
||||
- name: Create Vaultwarden systemd service
|
||||
ansible.builtin.copy:
|
||||
content: |
|
||||
[Unit]
|
||||
Description=Vaultwarden Password Manager
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
User={{ vaultwarden_user }}
|
||||
Group={{ vaultwarden_group }}
|
||||
Environment=DATA_FOLDER={{ vaultwarden_data_dir }}
|
||||
Environment=WEB_VAULT_FOLDER={{ vaultwarden_webvault_dir }}
|
||||
ExecStart={{ vaultwarden_install_dir }}/vaultwarden
|
||||
Restart=on-failure
|
||||
RestartSec=5s
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
dest: /etc/systemd/system/vaultwarden.service
|
||||
mode: '0644'
|
||||
become: true
|
||||
|
||||
- name: Enable and start Vaultwarden service
|
||||
ansible.builtin.systemd:
|
||||
name: vaultwarden
|
||||
enabled: "{{ vaultwarden_service_enabled }}"
|
||||
state: "{{ vaultwarden_service_state }}"
|
||||
daemon_reload: true
|
||||
become: true
|
||||
Reference in New Issue
Block a user