bitwarden.yml

bitwarden.yml

---
- name: Setup Vaultwarden
  hosts: target
  become: yes
  become_user: root
  tasks:
    - include: ../tasks/base.yml

    - name: Install libs
      dnf:
        name:
          - libpq-devel
          - libsqlite3x-devel
          - openssl
          - openssl-devel
        state: latest

    - name: Install remote files
      synchronize:
        src: ../../binary/passwd/
        dest: /
        recursive: yes
        group: no
        owner: no
        perms: no
        
    - name: Install service file
      copy:
        dest: /usr/lib/systemd/system/bitwarden_rs.service
        content: |
          [Unit]
          Description=bitwarden_rs
          After=network.target

          [Service]
          ExecStart=/opt/vaultwarden/target/release/vaultwarden
          Environment=WEB_VAULT_ENABLED=true
          Environment=DATA_FOLDER=/var/lib/bitwarden_rs
          Environment=DATABASE_URL=postgresql://username:[email protected]:5432/vaultwarden
          User=bitwarden_rs
          Group=bitwarden_rs

          [Install]
          WantedBy=multi-user.target


    - name: repair file permissions
      shell: |
        chown root:root /usr/lib/systemd/system/bitwarden_rs.service
        chmod 644 /usr/lib/systemd/system/bitwarden_rs.service

    - name: Install Rust
      shell: /opt/rustup -y

    - name: Clone vaultwarden code
      git:
        repo: https://github.com/dani-garcia/vaultwarden
        dest: /opt/vaultwarden

    - name: Create bitwarden_rs group
      group:
        name: bitwarden_rs

    - name: Create bitwarden_rs user
      user:
        name: bitwarden_rs
        group: bitwarden_rs
        home: /opt/vaultwarden

    - name: Build vaultwarden
      shell: cd /opt/vaultwarden && cargo build --features sqlite,postgresql --release --verbose

    - name: Extract web-vault archive
      unarchive:
        src: /opt/bw_web.tar.gz
        dest: /
        remote_src: yes

    - name: Restart services
      systemd:
        name: bitwarden_rs
        state: restarted
        enabled: yes
        daemon_reload: true