feat: initial installation role for vaultwarden

.gitignore

@@ -0,0 +1 @@
+*.retry

README.md

@@ -0,0 +1,43 @@
+# ansible-role-vaultwarden
+
+Builds Vaultwarden from source using Rust and installs the binary alongside
+the web vault UI (from dani-garcia/bw_web_builds). Sets up a systemd service.
+
+Build time is significant (10-20 minutes depending on hardware). The role
+is idempotent: it only rebuilds when the target version changes.
+
+The service user and group must be created beforehand.
+
+## Requirements
+
+- Ansible >= 2.14
+- Debian or Ubuntu
+- Internet access (downloads Rust toolchain, source code, web vault)
+
+## Role Variables
+
+| Variable | Default | Description |
+|---|---|---|
+| `vaultwarden_version` | `""` | Version tag to build (empty = latest) |
+| `vaultwarden_user` | `vaultwarden` | User to run Vaultwarden |
+| `vaultwarden_group` | `vaultwarden` | Group to run Vaultwarden |
+| `vaultwarden_install_dir` | `/opt/vaultwarden` | Binary installation directory |
+| `vaultwarden_data_dir` | `/var/lib/vaultwarden` | Data directory (SQLite DB, attachments) |
+| `vaultwarden_webvault_dir` | `/opt/vaultwarden/web-vault` | Web vault static files |
+| `vaultwarden_service_enabled` | `true` | Enable service at boot |
+| `vaultwarden_service_state` | `started` | Service state after installation |
+
+## Example Playbook
+
+```yaml
+- hosts: servers
+  roles:
+    - role: ansible-role-vaultwarden
+      vars:
+        vaultwarden_user: vaultwarden
+        vaultwarden_group: vaultwarden
+```
+
+## License
+
+MIT

defaults/main.yml

@@ -0,0 +1,9 @@
+---
+vaultwarden_version: ""
+vaultwarden_user: vaultwarden
+vaultwarden_group: vaultwarden
+vaultwarden_install_dir: /opt/vaultwarden
+vaultwarden_data_dir: /var/lib/vaultwarden
+vaultwarden_webvault_dir: /opt/vaultwarden/web-vault
+vaultwarden_service_enabled: true
+vaultwarden_service_state: started

handlers/main.yml

@@ -0,0 +1 @@
+---

meta/main.yml

@@ -0,0 +1,13 @@
+---
+galaxy_info:
+  author: mathieu
+  description: Build and install Vaultwarden from source on Linux
+  license: MIT
+  min_ansible_version: "2.14"
+  platforms:
+    - name: Debian
+      versions: [bullseye, bookworm]
+    - name: Ubuntu
+      versions: [focal, jammy, noble]
+  galaxy_tags: [vaultwarden, bitwarden, passwords]
+dependencies: []

tasks/main.yml

@@ -0,0 +1,221 @@
+---
+- name: Assert Debian-based distribution
+  ansible.builtin.assert:
+    that:
+      - ansible_os_family == 'Debian'
+    fail_msg: "ansible-role-vaultwarden only supports Debian-based distributions"
+
+- name: Install build dependencies
+  ansible.builtin.apt:
+    name:
+      - build-essential
+      - curl
+      - pkg-config
+      - libssl-dev
+      - libsqlite3-dev
+    state: present
+    update_cache: true
+  become: true
+
+- name: Install Rust toolchain via rustup
+  ansible.builtin.shell:
+    cmd: curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --no-modify-path
+    creates: /root/.cargo/bin/cargo
+  become: true
+
+- name: Get Vaultwarden release info from GitHub
+  ansible.builtin.uri:
+    url: >-
+      {{ 'https://api.github.com/repos/dani-garcia/vaultwarden/releases/latest'
+         if vaultwarden_version == ''
+         else 'https://api.github.com/repos/dani-garcia/vaultwarden/releases/tags/' + vaultwarden_version }}
+    headers:
+      Accept: "application/vnd.github.v3+json"
+    return_content: true
+  register: _vaultwarden_release
+
+- name: Set Vaultwarden version tag fact
+  ansible.builtin.set_fact:
+    _vaultwarden_version_tag: "{{ _vaultwarden_release.json.tag_name }}"
+
+- name: Read installed version
+  ansible.builtin.slurp:
+    src: "{{ vaultwarden_install_dir }}/.version"
+  register: _vaultwarden_installed_raw
+  ignore_errors: true
+  become: true
+
+- name: Set installed version fact
+  ansible.builtin.set_fact:
+    _vaultwarden_installed_version: >-
+      {{ (_vaultwarden_installed_raw.content | b64decode | trim)
+         if _vaultwarden_installed_raw is not failed else '' }}
+
+- name: Build and install Vaultwarden
+  when: _vaultwarden_installed_version != _vaultwarden_version_tag
+  block:
+    - name: Download Vaultwarden source archive
+      ansible.builtin.get_url:
+        url: "https://github.com/dani-garcia/vaultwarden/archive/refs/tags/{{ _vaultwarden_version_tag }}.tar.gz"
+        dest: /tmp/vaultwarden-src.tar.gz
+        mode: '0644'
+
+    - name: Create build directory
+      ansible.builtin.file:
+        path: /tmp/vaultwarden-build
+        state: directory
+        mode: '0755'
+
+    - name: Extract Vaultwarden source
+      ansible.builtin.unarchive:
+        src: /tmp/vaultwarden-src.tar.gz
+        dest: /tmp/vaultwarden-build
+        remote_src: true
+        extra_opts: [--strip-components=1]
+
+    - name: Build Vaultwarden binary
+      ansible.builtin.command:
+        cmd: /root/.cargo/bin/cargo build --release --features sqlite
+        chdir: /tmp/vaultwarden-build
+      become: true
+
+    - name: Create Vaultwarden installation directory
+      ansible.builtin.file:
+        path: "{{ vaultwarden_install_dir }}"
+        state: directory
+        owner: "{{ vaultwarden_user }}"
+        group: "{{ vaultwarden_group }}"
+        mode: '0755'
+      become: true
+
+    - name: Install Vaultwarden binary
+      ansible.builtin.copy:
+        src: /tmp/vaultwarden-build/target/release/vaultwarden
+        dest: "{{ vaultwarden_install_dir }}/vaultwarden"
+        remote_src: true
+        owner: "{{ vaultwarden_user }}"
+        group: "{{ vaultwarden_group }}"
+        mode: '0755'
+      become: true
+
+    - name: Write installed version file
+      ansible.builtin.copy:
+        content: "{{ _vaultwarden_version_tag }}"
+        dest: "{{ vaultwarden_install_dir }}/.version"
+        owner: "{{ vaultwarden_user }}"
+        group: "{{ vaultwarden_group }}"
+        mode: '0644'
+      become: true
+
+    - name: Clean up build artifacts
+      ansible.builtin.file:
+        path: "{{ item }}"
+        state: absent
+      loop:
+        - /tmp/vaultwarden-src.tar.gz
+        - /tmp/vaultwarden-build
+
+- name: Get latest web vault release info
+  ansible.builtin.uri:
+    url: https://api.github.com/repos/dani-garcia/bw_web_builds/releases/latest
+    headers:
+      Accept: "application/vnd.github.v3+json"
+    return_content: true
+  register: _webvault_release
+
+- name: Set web vault download URL
+  ansible.builtin.set_fact:
+    _webvault_download_url: >-
+      {{ _webvault_release.json.assets
+         | selectattr('name', 'search', 'bw_web_.*\\.tar\\.gz')
+         | map(attribute='browser_download_url')
+         | first }}
+
+- name: Read installed web vault version
+  ansible.builtin.slurp:
+    src: "{{ vaultwarden_webvault_dir }}/.version"
+  register: _webvault_installed_raw
+  ignore_errors: true
+  become: true
+
+- name: Install or upgrade web vault
+  when: >-
+    (_webvault_installed_raw is failed)
+    or (_webvault_installed_raw.content | b64decode | trim) != _webvault_release.json.tag_name
+  block:
+    - name: Download web vault archive
+      ansible.builtin.get_url:
+        url: "{{ _webvault_download_url }}"
+        dest: /tmp/web-vault.tar.gz
+        mode: '0644'
+
+    - name: Create web vault directory
+      ansible.builtin.file:
+        path: "{{ vaultwarden_webvault_dir }}"
+        state: directory
+        owner: "{{ vaultwarden_user }}"
+        group: "{{ vaultwarden_group }}"
+        mode: '0755'
+      become: true
+
+    - name: Extract web vault
+      ansible.builtin.unarchive:
+        src: /tmp/web-vault.tar.gz
+        dest: "{{ vaultwarden_install_dir }}"
+        remote_src: true
+        owner: "{{ vaultwarden_user }}"
+        group: "{{ vaultwarden_group }}"
+      become: true
+
+    - name: Write web vault version file
+      ansible.builtin.copy:
+        content: "{{ _webvault_release.json.tag_name }}"
+        dest: "{{ vaultwarden_webvault_dir }}/.version"
+        owner: "{{ vaultwarden_user }}"
+        group: "{{ vaultwarden_group }}"
+        mode: '0644'
+      become: true
+
+    - name: Remove web vault archive
+      ansible.builtin.file:
+        path: /tmp/web-vault.tar.gz
+        state: absent
+
+- name: Create Vaultwarden data directory
+  ansible.builtin.file:
+    path: "{{ vaultwarden_data_dir }}"
+    state: directory
+    owner: "{{ vaultwarden_user }}"
+    group: "{{ vaultwarden_group }}"
+    mode: '0750'
+  become: true
+
+- name: Create Vaultwarden systemd service
+  ansible.builtin.copy:
+    content: |
+      [Unit]
+      Description=Vaultwarden Password Manager
+      After=network.target
+
+      [Service]
+      User={{ vaultwarden_user }}
+      Group={{ vaultwarden_group }}
+      Environment=DATA_FOLDER={{ vaultwarden_data_dir }}
+      Environment=WEB_VAULT_FOLDER={{ vaultwarden_webvault_dir }}
+      ExecStart={{ vaultwarden_install_dir }}/vaultwarden
+      Restart=on-failure
+      RestartSec=5s
+
+      [Install]
+      WantedBy=multi-user.target
+    dest: /etc/systemd/system/vaultwarden.service
+    mode: '0644'
+  become: true
+
+- name: Enable and start Vaultwarden service
+  ansible.builtin.systemd:
+    name: vaultwarden
+    enabled: "{{ vaultwarden_service_enabled }}"
+    state: "{{ vaultwarden_service_state }}"
+    daemon_reload: true
+  become: true