Archive Legacy Setup And Add Ansible Control Plane

2026-07-08 12:47:37 +03:00
parent 841d56380b
commit 4bafa7d09e
203 changed files with 1663 additions and 11 deletions
@@ -0,0 +1,65 @@
+- name: Configure Vaultwarden reverse proxy on ru-vps
+  hosts: ru-vps
+  gather_facts: false
+  vars:
+    caddy_dir: /opt/services/ru-vps/caddy
+    caddyfile_path: /opt/services/ru-vps/caddy/Caddyfile
+    vaultwarden_domain: pass.ada-dev.ru
+    vaultwarden_upstream: 192.168.1.24:80
+
+  tasks:
+    - name: Ensure Caddy service directory exists
+      ansible.builtin.file:
+        path: "{{ caddy_dir }}"
+        state: directory
+        owner: root
+        group: root
+        mode: "0755"
+
+    - name: Configure Vaultwarden Caddy site
+      ansible.builtin.blockinfile:
+        path: "{{ caddyfile_path }}"
+        create: true
+        owner: root
+        group: root
+        mode: "0644"
+        marker: "# {mark} ANSIBLE MANAGED VAULTWARDEN SITE"
+        block: |
+          {{ vaultwarden_domain }} {
+            reverse_proxy {{ vaultwarden_upstream }}
+          }
+      register: vaultwarden_caddy_site
+
+    - name: Remove legacy unmanaged Vaultwarden Caddy site
+      ansible.builtin.replace:
+        path: "{{ caddyfile_path }}"
+        regexp: '(?ms)^pass\.ada-dev\.ru \{\n\s*reverse_proxy 10\.122\.62\.95:10380\n\}\n+'
+        replace: ''
+      register: vaultwarden_legacy_site
+
+    - name: Validate host Caddy config
+      ansible.builtin.command: caddy validate --config {{ caddyfile_path }}
+      changed_when: false
+
+    - name: Check Caddy container mounted config
+      ansible.builtin.command: docker exec caddy grep -F 'reverse_proxy {{ vaultwarden_upstream }}' /etc/caddy/Caddyfile
+      register: vaultwarden_container_caddyfile
+      changed_when: false
+      failed_when: false
+
+    - name: Restart Caddy when config changed or bind mount is stale
+      ansible.builtin.command: docker restart caddy
+      when: >-
+        vaultwarden_caddy_site.changed or
+        vaultwarden_legacy_site.changed or
+        vaultwarden_container_caddyfile.rc != 0
+
+    - name: Validate Caddy container config after restart
+      ansible.builtin.command: docker exec caddy caddy validate --config /etc/caddy/Caddyfile
+      changed_when: false
+
+    - name: Check Vaultwarden upstream from ru-vps
+      ansible.builtin.command: curl -fsS -o /dev/null -w '%{http_code}' http://{{ vaultwarden_upstream }}/
+      register: vaultwarden_upstream_http
+      changed_when: false
+      failed_when: vaultwarden_upstream_http.stdout != '200'