homelab/roles/bitwarden/tasks/main.yml

105 lines
3.1 KiB
YAML
Raw Normal View History

2020-06-13 05:12:23 +00:00
- name: Install expect
2023-05-04 03:42:55 +00:00
ansible.builtin.apt:
2020-06-13 05:12:23 +00:00
name: expect
state: present
- name: Create Bitwarden directory
2023-05-04 03:42:55 +00:00
ansible.builtin.file:
2021-02-27 05:00:52 +00:00
path: "{{ bitwarden_root }}"
2020-06-13 05:12:23 +00:00
state: directory
- name: Download Bitwarden script
2023-05-04 03:42:55 +00:00
ansible.builtin.get_url:
2020-06-13 05:12:23 +00:00
url: "https://raw.githubusercontent.com/\
2022-05-20 03:19:09 +00:00
bitwarden/self-host/master/bitwarden.sh"
2021-02-27 05:00:52 +00:00
dest: "{{ bitwarden_root }}"
2020-06-13 05:12:23 +00:00
mode: u+x
- name: Install Bitwarden script wrapper
2023-05-04 03:42:55 +00:00
ansible.builtin.template:
2020-06-13 05:12:23 +00:00
src: bw_wrapper.j2
2021-02-27 05:00:52 +00:00
dest: "{{ bitwarden_root }}/bw_wrapper"
2020-06-13 05:12:23 +00:00
mode: u+x
2021-02-27 05:00:52 +00:00
- name: Run Bitwarden installation script
2023-05-04 03:42:55 +00:00
ansible.builtin.shell: "{{ bitwarden_root }}/bw_wrapper"
2021-02-27 05:00:52 +00:00
args:
creates: "{{ bitwarden_root }}/bwdata/config.yml"
- name: Install docker-compose override
2023-05-04 03:42:55 +00:00
ansible.builtin.template:
2021-02-27 05:00:52 +00:00
src: compose.override.yml.j2
dest: "{{ bitwarden_root }}/bwdata/docker/docker-compose.override.yml"
2022-05-22 04:19:56 +00:00
when: traefik_version is defined
2022-05-27 04:03:49 +00:00
notify: rebuild_bitwarden
2021-02-27 05:00:52 +00:00
- name: Disable bitwarden-nginx HTTP on 80
2023-05-04 03:42:55 +00:00
ansible.builtin.replace:
2021-02-27 05:00:52 +00:00
path: "{{ bitwarden_root }}/bwdata/config.yml"
regexp: "^http_port: 80$"
2022-05-27 04:03:49 +00:00
replace: "http_port: 127.0.0.1:8080"
2021-02-27 05:00:52 +00:00
when: not bitwarden_standalone
2022-05-27 04:03:49 +00:00
notify: rebuild_bitwarden
2021-02-27 05:00:52 +00:00
- name: Disable bitwarden-nginx HTTPS on 443
2023-05-04 03:42:55 +00:00
ansible.builtin.replace:
2021-02-27 05:00:52 +00:00
path: "{{ bitwarden_root }}/bwdata/config.yml"
regexp: "^https_port: 443$"
2022-05-27 04:03:49 +00:00
replace: "https_port: 127.0.0.1:8443"
2021-02-27 05:00:52 +00:00
when: not bitwarden_standalone
2022-05-27 04:03:49 +00:00
notify: rebuild_bitwarden
2021-02-27 05:00:52 +00:00
- name: Disable Bitwarden managed Lets Encrypt
2023-05-04 03:42:55 +00:00
ansible.builtin.replace:
2021-02-27 05:00:52 +00:00
path: "{{ bitwarden_root }}/bwdata/config.yml"
regexp: "^ssl_managed_lets_encrypt: true$"
replace: "ssl_managed_lets_encrypt: false"
when: not bitwarden_standalone or not bitwarden_production
2022-05-27 04:03:49 +00:00
notify: rebuild_bitwarden
2021-02-27 05:00:52 +00:00
- name: Disable Bitwarden managed SSL
2023-05-04 03:42:55 +00:00
ansible.builtin.replace:
2021-02-27 05:00:52 +00:00
path: "{{ bitwarden_root }}/bwdata/config.yml"
regexp: "^ssl: true$"
replace: "ssl: false"
when: not bitwarden_standalone
2022-05-27 04:03:49 +00:00
notify: rebuild_bitwarden
- name: Define reverse proxy servers
2023-05-04 03:42:55 +00:00
ansible.builtin.lineinfile:
path: "{{ bitwarden_root }}/bwdata/config.yml"
line: "- {{ bitwarden_realips }}"
insertafter: "^real_ips"
2022-06-28 00:21:25 +00:00
notify: rebuild_bitwarden
2022-05-27 04:03:49 +00:00
- name: Install Bitwarden systemd service
2023-05-04 03:42:55 +00:00
ansible.builtin.template:
2022-05-27 04:03:49 +00:00
src: bitwarden.service.j2
dest: "/etc/systemd/system/{{ bitwarden_name }}.service"
register: bitwarden_systemd
notify: rebuild_bitwarden
2022-06-07 04:25:47 +00:00
- name: Create Bitwarden's initial logging directory
2023-05-04 03:42:55 +00:00
ansible.builtin.file:
2022-06-07 04:25:47 +00:00
path: "{{ bitwarden_logs_identity }}"
state: directory
register: bitwarden_logs
- name: Create Bitwarden's initial log file
2023-05-04 03:42:55 +00:00
ansible.builtin.file:
2022-06-07 04:25:47 +00:00
path: "{{ bitwarden_logs_identity }}/{{ bitwarden_logs_identity_date }}.txt"
state: touch
when: bitwarden_logs.changed
2022-05-28 06:31:41 +00:00
- name: Install Bitwarden's Fail2ban jail
2023-05-04 03:42:55 +00:00
ansible.builtin.template:
2022-05-28 06:31:41 +00:00
src: fail2ban-jail.conf.j2
dest: /etc/fail2ban/jail.d/bitwarden.conf
notify: restart_fail2ban
2022-05-27 04:03:49 +00:00
- name: Reload systemd manager configuration
2023-05-04 03:42:55 +00:00
ansible.builtin.systemd:
2022-05-27 04:03:49 +00:00
daemon_reload: true
when: bitwarden_systemd.changed
notify: rebuild_bitwarden