Migrate Bitwarden to rootless Podman with SELinux

roles/bitwarden/templates/bitwarden.service.j2

@@ -1,13 +1,19 @@
 [Unit]
 Description=Bitwarden Password Manager Server
-PartOf=docker.service
-After=docker.service
+Requires=podman.socket
+After=podman.socket
+StartLimitIntervalSec=300
+StartLimitBurst=5
 
 [Service]
-Type=oneshot
+Type=exec
 RemainAfterExit=true
-ExecStart={{ bitwarden_root }}/bitwarden.sh start
-ExecStop={{ bitwarden_root }}/bitwarden.sh stop
+WorkingDirectory={{ bitwarden_root }}
+Environment=DOCKER_HOST=unix://%t/podman/podman.sock
+ExecStart={{ bitwarden_script }} start
+ExecStop={{ bitwarden_script }} stop
+Restart=on-failure
+RestartSec=10
 
 [Install]
-WantedBy=multi-user.target
+WantedBy=default.target

roles/bitwarden/templates/compose.override.yml.j2

@@ -1,16 +1,16 @@
-version: '3'
-
+# {{ ansible_managed }}
 services:
-  nginx:
-    networks:
-      - traefik
-    labels:
-      traefik.http.routers.bitwarden.rule: "Host(`{{ bitwarden_domain }}`)"
-      traefik.http.routers.bitwarden.entrypoints: {{ bitwarden_entrypoint | default('web') }}
-      traefik.http.routers.bitwarden.tls: {{ bitwarden_traefik_tls | default('false') }}
-      traefik.http.services.bitwarden.loadbalancer.server.port: 8080
-      traefik.docker.network: traefik
-      traefik.enable: "true"
-networks:
-  traefik:
-    external: true
+{% for service in bitwarden_services %}
+  {{ service }}:
+{% if service == 'nginx' %}
+    user: "0:0"
+{% endif %}
+{% if service == 'identity' %}
+    environment:
+      globalSettings__knownNetworks: "{{ bitwarden_realips }}"
+    volumes:
+      - {{ bitwarden_logs }}/identity:/etc/bitwarden/logs
+{% endif %}
+    security_opt:
+      - label=level:{{ bitwarden_se_level }}
+{% endfor %}

roles/bitwarden/templates/fail2ban-filter.conf.j2

@@ -0,0 +1,4 @@
+# {{ ansible_managed }}
+[Definition]
+failregex = Failed login attempt.*IpAddress: "<ADDR>"
+ignoreregex =

roles/bitwarden/templates/fail2ban-jail.conf.j2

@@ -2,7 +2,7 @@
 [bitwarden]
 enabled = true
 filter = bitwarden
-logpath = {{ bitwarden_root }}/bwdata/logs/identity/Identity/*
+logpath = {{ bitwarden_logs_identity }}/*
 maxretry = 10
 findtime = 3600
 bantime = 900