--- - name: Guard Vaultwarden VMID before API updates hosts: mini-pc gather_facts: false pre_tasks: - name: Skip legacy Vaultwarden provisioning for runtime-only calls ansible.builtin.meta: end_play when: not (pve_provisioning_enabled | default(true) | bool) tasks: - name: Read existing VMID 140 configuration ansible.builtin.command: pct config 140 register: vaultwarden_existing_vmid changed_when: false failed_when: false - name: Refuse to modify a foreign VMID 140 ansible.builtin.assert: that: - vaultwarden_existing_vmid.rc != 0 or vaultwarden_existing_hostname == 'vaultwarden' fail_msg: VMID 140 already exists and is not the Vaultwarden container. vars: vaultwarden_existing_hostname: >- {{ vaultwarden_existing_vmid.stdout_lines | select('match', '^hostname: ') | map('regex_replace', '^hostname: ', '') | first | default('') }} - name: Create Vaultwarden LXC on mini-pc hosts: mini-pc gather_facts: false pre_tasks: - name: Skip legacy Vaultwarden provisioning for runtime-only calls ansible.builtin.meta: end_play when: not (pve_provisioning_enabled | default(true) | bool) vars: vaultwarden_vmid: 140 vaultwarden_hostname: vaultwarden vaultwarden_ip: 192.168.1.24/24 vaultwarden_gateway: 192.168.1.1 vaultwarden_bridge: vmbr0 vaultwarden_rootfs: local-lvm:16 vaultwarden_ostemplate: local:vztmpl/debian-13-standard_13.1-2_amd64.tar.zst vaultwarden_pubkey_file: ~/.ssh/id_ed25519_homelab.pub handlers: - name: restart vaultwarden lxc ansible.builtin.shell: "pct stop {{ vaultwarden_vmid }} || true; pct start {{ vaultwarden_vmid }}" changed_when: true tasks: - name: Check if Vaultwarden LXC exists ansible.builtin.command: "pct config {{ vaultwarden_vmid }}" register: vaultwarden_pct_config changed_when: false failed_when: false - name: Install Vaultwarden LXC SSH public key on PVE host ansible.builtin.copy: dest: /tmp/vaultwarden-lxc.pub owner: root group: root mode: "0600" content: "{{ lookup('file', vaultwarden_pubkey_file) }}\n" when: vaultwarden_pct_config.rc != 0 - name: Create Vaultwarden LXC ansible.builtin.command: >- pct create {{ vaultwarden_vmid }} {{ vaultwarden_ostemplate }} --hostname {{ vaultwarden_hostname }} --rootfs {{ vaultwarden_rootfs }} --cores 2 --memory 1024 --swap 512 --net0 name=eth0,bridge={{ vaultwarden_bridge }},gw={{ vaultwarden_gateway }},ip={{ vaultwarden_ip }},firewall=1 --nameserver 1.1.1.1 --unprivileged 1 --features nesting=1,keyctl=1 --onboot 1 --startup order=40 --cmode shell --ssh-public-keys /tmp/vaultwarden-lxc.pub when: vaultwarden_pct_config.rc != 0 - name: Start Vaultwarden LXC ansible.builtin.command: "pct start {{ vaultwarden_vmid }}" register: vaultwarden_pct_start changed_when: vaultwarden_pct_start.rc == 0 failed_when: vaultwarden_pct_start.rc not in [0, 255] - name: Allow FUSE device in Vaultwarden LXC config ansible.builtin.lineinfile: path: "/etc/pve/lxc/{{ vaultwarden_vmid }}.conf" line: "lxc.cgroup2.devices.allow: c 10:229 rwm" state: present notify: restart vaultwarden lxc - name: Bind mount FUSE device in Vaultwarden LXC config ansible.builtin.lineinfile: path: "/etc/pve/lxc/{{ vaultwarden_vmid }}.conf" line: "lxc.mount.entry: /dev/fuse dev/fuse none bind,create=file" state: present notify: restart vaultwarden lxc - name: Apply pending LXC config changes ansible.builtin.meta: flush_handlers - name: Wait for Vaultwarden SSH through ru-vps ansible.builtin.wait_for_connection: timeout: 120 delegate_to: vaultwarden vars: ansible_become: false - name: Configure Docker and Vaultwarden inside LXC # Таргет переопределяем ради blue-green переезда на OpenTofu: во время # миграции этот play нужно прогнать против нового контейнера на временном # адресе. Просто `--limit vaultwarden-new` для этого НЕ годится — лимит # пересекается с паттерном play и даёт ноль хостов, а не перенацеливание # (проверено 2026-09-02 через --list-hosts на всех плейбуках). # Использовать вместе с --limit, чтобы play создания контейнера отсеялся: # ansible-playbook playbooks/pve-vaultwarden.yml \ # -e pve_config_target=vaultwarden-new --limit vaultwarden-new # По умолчанию поведение не меняется. hosts: "{{ pve_config_target | default('vaultwarden') }}" gather_facts: true vars: ansible_become: false vaultwarden_data_dir: /opt/vaultwarden/data vaultwarden_image: vaultwarden/server:1.37.1@sha256:e9efdf001bf0d68c21f2cbfb8e1d9b5961a7ca9c85e0a7e58bf51a13b997d744 vaultwarden_container_name: vaultwarden vaultwarden_http_port: 80 tasks: - name: Install Docker packages ansible.builtin.apt: name: - docker.io - fuse-overlayfs - sqlite3 - ca-certificates - curl state: present update_cache: true - name: Ensure Docker config directory exists ansible.builtin.file: path: /etc/docker state: directory owner: root group: root mode: "0755" - name: Configure Docker storage driver for unprivileged LXC ansible.builtin.copy: dest: /etc/docker/daemon.json owner: root group: root mode: "0644" content: | { "storage-driver": "fuse-overlayfs" } register: docker_daemon_config - name: Ensure Docker service is enabled and running ansible.builtin.systemd: name: docker state: "{{ 'restarted' if docker_daemon_config.changed else 'started' }}" enabled: true - name: Ensure Vaultwarden data directory exists ansible.builtin.file: path: "{{ vaultwarden_data_dir }}" state: directory owner: root group: root mode: "0750" - name: Check if the configured Vaultwarden image is present ansible.builtin.command: "docker image inspect {{ vaultwarden_image }}" register: vaultwarden_image_inspect changed_when: false failed_when: false - name: Pull the configured Vaultwarden image ansible.builtin.command: "docker pull {{ vaultwarden_image }}" when: vaultwarden_image_inspect.rc != 0 register: vaultwarden_image_pull changed_when: true - name: Install Vaultwarden systemd unit ansible.builtin.copy: dest: /etc/systemd/system/vaultwarden.service owner: root group: root mode: "0644" content: | [Unit] Description=Vaultwarden container After=docker.service Requires=docker.service [Service] Restart=always RestartSec=10 ExecStartPre=-/usr/bin/docker rm -f {{ vaultwarden_container_name }} ExecStart=/usr/bin/docker run --rm \ --name {{ vaultwarden_container_name }} \ --pull never \ -p {{ vaultwarden_http_port }}:80 \ -v {{ vaultwarden_data_dir }}:/data \ -e WEBSOCKET_ENABLED=true \ {{ vaultwarden_image }} ExecStop=/usr/bin/docker stop {{ vaultwarden_container_name }} [Install] WantedBy=multi-user.target register: vaultwarden_unit - name: Reload systemd when Vaultwarden unit changes ansible.builtin.systemd: daemon_reload: true when: vaultwarden_unit.changed - name: Enable and start Vaultwarden ansible.builtin.systemd: name: vaultwarden state: "{{ 'restarted' if vaultwarden_unit.changed or vaultwarden_image_pull.changed else 'started' }}" enabled: true - name: Wait for Vaultwarden HTTP endpoint ansible.builtin.uri: url: "http://127.0.0.1:{{ vaultwarden_http_port }}/" status_code: 200 register: vaultwarden_health retries: 24 delay: 5 until: vaultwarden_health.status == 200 - name: Verify Docker storage driver ansible.builtin.command: docker info --format '{{ "{{" }}.Driver{{ "}}" }}' register: vaultwarden_docker_driver changed_when: false failed_when: vaultwarden_docker_driver.stdout != 'fuse-overlayfs'