ansible-role-vaultwarden/tasks/main.yml

---
- name: Assert Debian-based distribution
  ansible.builtin.assert:
    that:
      - ansible_os_family == 'Debian'
    fail_msg: "ansible-role-vaultwarden only supports Debian-based distributions"

- name: Install build dependencies
  ansible.builtin.apt:
    name:
      - build-essential
      - curl
      - pkg-config
      - libssl-dev
      - libsqlite3-dev
    state: present
    update_cache: true
  become: true

- name: Install Rust toolchain via rustup
  ansible.builtin.shell:
    cmd: curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --no-modify-path
    creates: /root/.cargo/bin/cargo
  become: true

- name: Get Vaultwarden release info from GitHub
  ansible.builtin.uri:
    url: >-
      {{ 'https://api.github.com/repos/dani-garcia/vaultwarden/releases/latest'
         if vaultwarden_version == ''
         else 'https://api.github.com/repos/dani-garcia/vaultwarden/releases/tags/' + vaultwarden_version }}
    headers:
      Accept: "application/vnd.github.v3+json"
    return_content: true
  register: _vaultwarden_release

- name: Set Vaultwarden version tag fact
  ansible.builtin.set_fact:
    _vaultwarden_version_tag: "{{ _vaultwarden_release.json.tag_name }}"

- name: Read installed version
  ansible.builtin.slurp:
    src: "{{ vaultwarden_install_dir }}/.version"
  register: _vaultwarden_installed_raw
  ignore_errors: true
  become: true

- name: Set installed version fact
  ansible.builtin.set_fact:
    _vaultwarden_installed_version: >-
      {{ (_vaultwarden_installed_raw.content | b64decode | trim)
         if _vaultwarden_installed_raw is not failed else '' }}

- name: Build and install Vaultwarden
  when: _vaultwarden_installed_version != _vaultwarden_version_tag
  block:
    - name: Download Vaultwarden source archive
      ansible.builtin.get_url:
        url: "https://github.com/dani-garcia/vaultwarden/archive/refs/tags/{{ _vaultwarden_version_tag }}.tar.gz"
        dest: /tmp/vaultwarden-src.tar.gz
        mode: '0644'

    - name: Create build directory
      ansible.builtin.file:
        path: /tmp/vaultwarden-build
        state: directory
        mode: '0755'

    - name: Extract Vaultwarden source
      ansible.builtin.unarchive:
        src: /tmp/vaultwarden-src.tar.gz
        dest: /tmp/vaultwarden-build
        remote_src: true
        extra_opts: [--strip-components=1]

    - name: Build Vaultwarden binary
      ansible.builtin.command:
        cmd: /root/.cargo/bin/cargo build --release --features sqlite
        chdir: /tmp/vaultwarden-build
      become: true

    - name: Create Vaultwarden installation directory
      ansible.builtin.file:
        path: "{{ vaultwarden_install_dir }}"
        state: directory
        owner: "{{ vaultwarden_user }}"
        group: "{{ vaultwarden_group }}"
        mode: '0755'
      become: true

    - name: Install Vaultwarden binary
      ansible.builtin.copy:
        src: /tmp/vaultwarden-build/target/release/vaultwarden
        dest: "{{ vaultwarden_install_dir }}/vaultwarden"
        remote_src: true
        owner: "{{ vaultwarden_user }}"
        group: "{{ vaultwarden_group }}"
        mode: '0755'
      become: true

    - name: Write installed version file
      ansible.builtin.copy:
        content: "{{ _vaultwarden_version_tag }}"
        dest: "{{ vaultwarden_install_dir }}/.version"
        owner: "{{ vaultwarden_user }}"
        group: "{{ vaultwarden_group }}"
        mode: '0644'
      become: true

    - name: Clean up build artifacts
      ansible.builtin.file:
        path: "{{ item }}"
        state: absent
      loop:
        - /tmp/vaultwarden-src.tar.gz
        - /tmp/vaultwarden-build

- name: Get latest web vault release info
  ansible.builtin.uri:
    url: https://api.github.com/repos/dani-garcia/bw_web_builds/releases/latest
    headers:
      Accept: "application/vnd.github.v3+json"
    return_content: true
  register: _webvault_release

- name: Set web vault download URL
  ansible.builtin.set_fact:
    _webvault_download_url: >-
      {{ _webvault_release.json.assets
         | selectattr('name', 'search', 'bw_web_.*\\.tar\\.gz')
         | map(attribute='browser_download_url')
         | first }}

- name: Read installed web vault version
  ansible.builtin.slurp:
    src: "{{ vaultwarden_webvault_dir }}/.version"
  register: _webvault_installed_raw
  ignore_errors: true
  become: true

- name: Install or upgrade web vault
  when: >-
    (_webvault_installed_raw is failed)
    or (_webvault_installed_raw.content | b64decode | trim) != _webvault_release.json.tag_name
  block:
    - name: Download web vault archive
      ansible.builtin.get_url:
        url: "{{ _webvault_download_url }}"
        dest: /tmp/web-vault.tar.gz
        mode: '0644'

    - name: Create web vault directory
      ansible.builtin.file:
        path: "{{ vaultwarden_webvault_dir }}"
        state: directory
        owner: "{{ vaultwarden_user }}"
        group: "{{ vaultwarden_group }}"
        mode: '0755'
      become: true

    - name: Extract web vault
      ansible.builtin.unarchive:
        src: /tmp/web-vault.tar.gz
        dest: "{{ vaultwarden_install_dir }}"
        remote_src: true
        owner: "{{ vaultwarden_user }}"
        group: "{{ vaultwarden_group }}"
      become: true

    - name: Write web vault version file
      ansible.builtin.copy:
        content: "{{ _webvault_release.json.tag_name }}"
        dest: "{{ vaultwarden_webvault_dir }}/.version"
        owner: "{{ vaultwarden_user }}"
        group: "{{ vaultwarden_group }}"
        mode: '0644'
      become: true

    - name: Remove web vault archive
      ansible.builtin.file:
        path: /tmp/web-vault.tar.gz
        state: absent

- name: Create Vaultwarden data directory
  ansible.builtin.file:
    path: "{{ vaultwarden_data_dir }}"
    state: directory
    owner: "{{ vaultwarden_user }}"
    group: "{{ vaultwarden_group }}"
    mode: '0750'
  become: true

- name: Create Vaultwarden systemd service
  ansible.builtin.copy:
    content: |
      [Unit]
      Description=Vaultwarden Password Manager
      After=network.target

      [Service]
      User={{ vaultwarden_user }}
      Group={{ vaultwarden_group }}
      Environment=DATA_FOLDER={{ vaultwarden_data_dir }}
      Environment=WEB_VAULT_FOLDER={{ vaultwarden_webvault_dir }}
      ExecStart={{ vaultwarden_install_dir }}/vaultwarden
      Restart=on-failure
      RestartSec=5s

      [Install]
      WantedBy=multi-user.target
    dest: /etc/systemd/system/vaultwarden.service
    mode: '0644'
  become: true

- name: Enable and start Vaultwarden service
  ansible.builtin.systemd:
    name: vaultwarden
    enabled: "{{ vaultwarden_service_enabled }}"
    state: "{{ vaultwarden_service_state }}"
    daemon_reload: true
  become: true