282 lines
9.1 KiB
YAML
282 lines
9.1 KiB
YAML
- name: Install expect
|
|
ansible.builtin.apt:
|
|
name: expect
|
|
state: present
|
|
|
|
- name: Create Bitwarden's containers config directory
|
|
ansible.builtin.file:
|
|
path: "/home/{{ bitwarden_user }}/.config/containers"
|
|
state: directory
|
|
owner: "{{ bitwarden_user }}"
|
|
group: "{{ bitwarden_user }}"
|
|
mode: "0755"
|
|
|
|
- name: Configure keep-id user namespace for Bitwarden's containers
|
|
ansible.builtin.copy:
|
|
content: |
|
|
[containers]
|
|
userns = "keep-id"
|
|
dest: "/home/{{ bitwarden_user }}/.config/containers/containers.conf"
|
|
owner: "{{ bitwarden_user }}"
|
|
group: "{{ bitwarden_user }}"
|
|
mode: "0644"
|
|
notify: rebuild_bitwarden
|
|
|
|
- name: Set SELinux context on Bitwarden's root directory
|
|
community.general.sefcontext:
|
|
target: "{{ bitwarden_root }}(/.*)?"
|
|
setype: container_file_t
|
|
selevel: "{{ bitwarden_se_level }}"
|
|
state: present
|
|
when: selinux is defined and selinux is not false
|
|
|
|
- name: Set SELinux context on Bitwarden's logging directory
|
|
community.general.sefcontext:
|
|
target: "{{ bitwarden_logs }}(/.*)?"
|
|
setype: oci_log_t
|
|
selevel: "{{ bitwarden_se_level }}"
|
|
state: present
|
|
when: selinux is defined and selinux is not false
|
|
|
|
- name: Install Bitwarden SELinux policy source
|
|
ansible.builtin.copy:
|
|
src: bitwarden.te
|
|
dest: "{{ podman_selinux_dir }}/bitwarden.te"
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
register: bitwarden_selinux_src
|
|
when: selinux is defined and selinux is not false
|
|
|
|
- name: Clear stale Bitwarden SELinux artifacts
|
|
ansible.builtin.file:
|
|
path: "{{ podman_selinux_dir }}/bitwarden.{{ item }}"
|
|
state: absent
|
|
loop: [mod, pp]
|
|
when:
|
|
- selinux is defined and selinux is not false
|
|
- bitwarden_selinux_src is changed
|
|
|
|
- name: Compile Bitwarden SELinux policy module
|
|
ansible.builtin.command:
|
|
cmd: >-
|
|
checkmodule -M -m -o {{ podman_selinux_dir }}/bitwarden.mod
|
|
{{ podman_selinux_dir }}/bitwarden.te
|
|
creates: "{{ podman_selinux_dir }}/bitwarden.mod"
|
|
when: selinux is defined and selinux is not false
|
|
|
|
- name: Package Bitwarden SELinux policy module
|
|
ansible.builtin.command:
|
|
cmd: >-
|
|
semodule_package -o {{ podman_selinux_dir }}/bitwarden.pp
|
|
-m {{ podman_selinux_dir }}/bitwarden.mod
|
|
creates: "{{ podman_selinux_dir }}/bitwarden.pp"
|
|
when: selinux is defined and selinux is not false
|
|
|
|
- name: List loaded SELinux policy modules for Bitwarden
|
|
ansible.builtin.command:
|
|
cmd: semodule -l
|
|
register: bitwarden_semodule_list
|
|
changed_when: false
|
|
when: selinux is defined and selinux is not false
|
|
|
|
- name: Load Bitwarden SELinux policy module
|
|
ansible.builtin.command:
|
|
cmd: semodule -i {{ podman_selinux_dir }}/bitwarden.pp
|
|
register: bitwarden_semodule
|
|
changed_when: bitwarden_semodule.rc == 0
|
|
when:
|
|
- selinux is defined and selinux is not false
|
|
- bitwarden_selinux_src is changed or "bitwarden" not in bitwarden_semodule_list.stdout_lines
|
|
notify: rebuild_bitwarden
|
|
|
|
- name: Create Bitwarden directory
|
|
ansible.builtin.file:
|
|
path: "{{ bitwarden_root }}"
|
|
state: directory
|
|
owner: "{{ bitwarden_user }}"
|
|
group: "{{ bitwarden_user }}"
|
|
mode: "0700"
|
|
setype: >-
|
|
{{ (selinux is defined and selinux is not false)
|
|
| ternary('container_file_t', omit) }}
|
|
selevel: "{{ bitwarden_se_level }}"
|
|
|
|
- name: Check whether the Bitwarden script is already installed
|
|
ansible.builtin.stat:
|
|
path: "{{ bitwarden_script }}"
|
|
register: bitwarden_script_stat
|
|
|
|
- name: Download Bitwarden script
|
|
ansible.builtin.get_url:
|
|
url: "https://raw.githubusercontent.com/\
|
|
bitwarden/self-host/master/bitwarden.sh"
|
|
dest: "{{ bitwarden_script }}"
|
|
force: false
|
|
owner: "{{ bitwarden_user }}"
|
|
group: "{{ bitwarden_user }}"
|
|
mode: "0750"
|
|
setype: >-
|
|
{{ (selinux is defined and selinux is not false)
|
|
| ternary('container_file_t', omit) }}
|
|
selevel: "{{ bitwarden_se_level }}"
|
|
when: not bitwarden_script_stat.stat.exists
|
|
|
|
- name: Install Bitwarden script wrapper
|
|
ansible.builtin.template:
|
|
src: bw_wrapper.j2
|
|
dest: "{{ bitwarden_root }}/bw_wrapper"
|
|
owner: "{{ bitwarden_user }}"
|
|
group: "{{ bitwarden_user }}"
|
|
mode: "0750"
|
|
setype: >-
|
|
{{ (selinux is defined and selinux is not false)
|
|
| ternary('container_file_t', omit) }}
|
|
selevel: "{{ bitwarden_se_level }}"
|
|
|
|
- name: Pin the SELinux level on newly downloaded run scripts
|
|
ansible.builtin.blockinfile:
|
|
path: "{{ bitwarden_script }}"
|
|
insertafter: '^\s*mv \$tmp_script \$SCRIPTS_DIR/run\.sh$'
|
|
marker: " # {mark} Ansible Managed: Add Bitwarden SELinux MCS level"
|
|
block: |2
|
|
sed -i \
|
|
"s|--name setup |&--security-opt {{ bitwarden_se_opt }} |g" \
|
|
"$SCRIPTS_DIR/run.sh"
|
|
when: selinux is defined and selinux is not false
|
|
|
|
- name: Give Bitwarden's setup container a writable working directory
|
|
ansible.builtin.blockinfile:
|
|
path: "{{ bitwarden_script }}"
|
|
insertafter: '^\s*mv \$tmp_script \$SCRIPTS_DIR/run\.sh$'
|
|
marker: " # {mark} Ansible Managed: Set Bitwarden's setup directory"
|
|
block: |2
|
|
sed -i \
|
|
"s|-it --rm --name setup |&-w /bitwarden |" \
|
|
"$SCRIPTS_DIR/run.sh"
|
|
|
|
- name: Run Bitwarden installation script
|
|
ansible.builtin.command: "{{ bitwarden_root }}/bw_wrapper"
|
|
args:
|
|
creates: "{{ bitwarden_data }}/config.yml"
|
|
become: true
|
|
become_user: "{{ bitwarden_user }}"
|
|
environment: "{{ bitwarden_env }}"
|
|
|
|
- name: Pin the SELinux level on Bitwarden's setup container
|
|
ansible.builtin.replace:
|
|
path: "{{ bitwarden_data }}/scripts/run.sh"
|
|
regexp: "--name setup(?! --security-opt)"
|
|
replace: "--name setup --security-opt label=level:{{ bitwarden_se_level }}"
|
|
when: selinux is defined and selinux is not false
|
|
notify: rebuild_bitwarden
|
|
|
|
- name: Install compose override
|
|
ansible.builtin.template:
|
|
src: compose.override.yml.j2
|
|
dest: "{{ bitwarden_data }}/docker/docker-compose.override.yml"
|
|
owner: "{{ bitwarden_user }}"
|
|
group: "{{ bitwarden_user }}"
|
|
mode: "0640"
|
|
setype: >-
|
|
{{ (selinux is defined and selinux is not false)
|
|
| ternary('container_file_t', omit) }}
|
|
selevel: "{{ bitwarden_se_level }}"
|
|
notify: rebuild_bitwarden
|
|
|
|
- name: Disable bitwarden-nginx HTTP on 80
|
|
ansible.builtin.replace:
|
|
path: "{{ bitwarden_data }}/config.yml"
|
|
regexp: "^http_port: 80$"
|
|
replace: "http_port: {{ bitwarden_http_port }}"
|
|
when: not bitwarden_standalone
|
|
notify: rebuild_bitwarden
|
|
|
|
- name: Disable bitwarden-nginx HTTPS on 443
|
|
ansible.builtin.replace:
|
|
path: "{{ bitwarden_data }}/config.yml"
|
|
regexp: "^https_port: 443$"
|
|
replace: "https_port: {{ bitwarden_https_port }}"
|
|
when: not bitwarden_standalone
|
|
notify: rebuild_bitwarden
|
|
|
|
- name: Disable Bitwarden managed Lets Encrypt
|
|
ansible.builtin.replace:
|
|
path: "{{ bitwarden_data }}/config.yml"
|
|
regexp: "^ssl_managed_lets_encrypt: true$"
|
|
replace: "ssl_managed_lets_encrypt: false"
|
|
when: not bitwarden_standalone or not bitwarden_production
|
|
notify: rebuild_bitwarden
|
|
|
|
- name: Disable Bitwarden managed SSL
|
|
ansible.builtin.replace:
|
|
path: "{{ bitwarden_data }}/config.yml"
|
|
regexp: "^ssl: true$"
|
|
replace: "ssl: false"
|
|
when: not bitwarden_standalone
|
|
notify: rebuild_bitwarden
|
|
|
|
- name: Define reverse proxy servers
|
|
ansible.builtin.lineinfile:
|
|
path: "{{ bitwarden_data }}/config.yml"
|
|
line: "- {{ bitwarden_realips }}"
|
|
insertafter: "^real_ips"
|
|
notify: rebuild_bitwarden
|
|
|
|
- name: Create user systemd directory for Bitwarden
|
|
ansible.builtin.file:
|
|
path: "/home/{{ bitwarden_user }}/.config/systemd/user"
|
|
state: directory
|
|
owner: "{{ bitwarden_user }}"
|
|
group: "{{ bitwarden_user }}"
|
|
mode: "0755"
|
|
|
|
- name: Install Bitwarden systemd service
|
|
ansible.builtin.template:
|
|
src: bitwarden.service.j2
|
|
dest: "/home/{{ bitwarden_user }}/.config/systemd/user/{{ bitwarden_name }}.service"
|
|
owner: "{{ bitwarden_user }}"
|
|
group: "{{ bitwarden_user }}"
|
|
mode: "0644"
|
|
notify: rebuild_bitwarden
|
|
|
|
- name: Create Bitwarden's initial logging directory
|
|
ansible.builtin.file:
|
|
path: "{{ bitwarden_logs_identity }}"
|
|
state: directory
|
|
owner: "{{ bitwarden_user }}"
|
|
group: "{{ bitwarden_user }}"
|
|
mode: "0755"
|
|
setype: >-
|
|
{{ (selinux is defined and selinux is not false)
|
|
| ternary('oci_log_t', omit) }}
|
|
selevel: "{{ bitwarden_se_level }}"
|
|
|
|
- name: Create Bitwarden's log file for Fail2ban
|
|
ansible.builtin.file:
|
|
path: "{{ bitwarden_logs_identity }}/{{ bitwarden_logs_identity_date }}.txt"
|
|
state: touch
|
|
owner: "{{ bitwarden_user }}"
|
|
group: "{{ bitwarden_user }}"
|
|
mode: "0644"
|
|
modification_time: preserve
|
|
access_time: preserve
|
|
setype: >-
|
|
{{ (selinux is defined and selinux is not false)
|
|
| ternary('oci_log_t', omit) }}
|
|
selevel: "{{ bitwarden_se_level }}"
|
|
|
|
- name: Install Bitwarden's Fail2ban filter
|
|
ansible.builtin.template:
|
|
src: fail2ban-filter.conf.j2
|
|
dest: /etc/fail2ban/filter.d/bitwarden.conf
|
|
mode: "0644"
|
|
notify: restart_fail2ban
|
|
|
|
- name: Install Bitwarden's Fail2ban jail
|
|
ansible.builtin.template:
|
|
src: fail2ban-jail.conf.j2
|
|
dest: /etc/fail2ban/jail.d/bitwarden.conf
|
|
mode: "640"
|
|
notify: restart_fail2ban
|