infra/ansible/playbooks/pve-vaultwarden.yml

- name: Create Vaultwarden LXC on mini-pc
  hosts: mini-pc
  gather_facts: false
  vars:
    vaultwarden_vmid: 140
    vaultwarden_hostname: vaultwarden
    vaultwarden_ip: 192.168.1.24/24
    vaultwarden_gateway: 192.168.1.1
    vaultwarden_bridge: vmbr0
    vaultwarden_rootfs: local-lvm:16
    vaultwarden_ostemplate: local:vztmpl/debian-13-standard_13.1-2_amd64.tar.zst
    vaultwarden_pubkey_file: ~/.ssh/id_ed25519_homelab.pub
  handlers:
    - name: restart vaultwarden lxc
      ansible.builtin.shell: "pct stop {{ vaultwarden_vmid }} || true; pct start {{ vaultwarden_vmid }}"
      changed_when: true
  tasks:
    - name: Check if Vaultwarden LXC exists
      ansible.builtin.command: "pct config {{ vaultwarden_vmid }}"
      register: vaultwarden_pct_config
      changed_when: false
      failed_when: false

    - name: Install Vaultwarden LXC SSH public key on PVE host
      ansible.builtin.copy:
        dest: /tmp/vaultwarden-lxc.pub
        owner: root
        group: root
        mode: "0600"
        content: "{{ lookup('file', vaultwarden_pubkey_file) }}\n"
      when: vaultwarden_pct_config.rc != 0

    - name: Create Vaultwarden LXC
      ansible.builtin.command: >-
        pct create {{ vaultwarden_vmid }} {{ vaultwarden_ostemplate }}
        --hostname {{ vaultwarden_hostname }}
        --rootfs {{ vaultwarden_rootfs }}
        --cores 2
        --memory 1024
        --swap 512
        --net0 name=eth0,bridge={{ vaultwarden_bridge }},gw={{ vaultwarden_gateway }},ip={{ vaultwarden_ip }},firewall=1
        --nameserver 1.1.1.1
        --unprivileged 1
        --features nesting=1,keyctl=1
        --onboot 1
        --startup order=40
        --cmode shell
        --ssh-public-keys /tmp/vaultwarden-lxc.pub
      when: vaultwarden_pct_config.rc != 0

    - name: Start Vaultwarden LXC
      ansible.builtin.command: "pct start {{ vaultwarden_vmid }}"
      register: vaultwarden_pct_start
      changed_when: vaultwarden_pct_start.rc == 0
      failed_when: vaultwarden_pct_start.rc not in [0, 255]

    - name: Allow FUSE device in Vaultwarden LXC config
      ansible.builtin.lineinfile:
        path: "/etc/pve/lxc/{{ vaultwarden_vmid }}.conf"
        line: "lxc.cgroup2.devices.allow: c 10:229 rwm"
        state: present
      notify: restart vaultwarden lxc

    - name: Bind mount FUSE device in Vaultwarden LXC config
      ansible.builtin.lineinfile:
        path: "/etc/pve/lxc/{{ vaultwarden_vmid }}.conf"
        line: "lxc.mount.entry: /dev/fuse dev/fuse none bind,create=file"
        state: present
      notify: restart vaultwarden lxc

    - name: Apply pending LXC config changes
      ansible.builtin.meta: flush_handlers

    - name: Wait for Vaultwarden SSH through ru-vps
      ansible.builtin.wait_for_connection:
        timeout: 120
      delegate_to: vaultwarden
      vars:
        ansible_become: false

- name: Configure Docker and Vaultwarden inside LXC
  hosts: vaultwarden
  gather_facts: true
  vars:
    ansible_become: false
    vaultwarden_data_dir: /opt/vaultwarden/data
    vaultwarden_image: vaultwarden/server:latest
    vaultwarden_container_name: vaultwarden
    vaultwarden_http_port: 80
  tasks:
    - name: Install Docker packages
      ansible.builtin.apt:
        name:
          - docker.io
          - fuse-overlayfs
          - sqlite3
          - ca-certificates
          - curl
        state: present
        update_cache: true

    - name: Ensure Docker config directory exists
      ansible.builtin.file:
        path: /etc/docker
        state: directory
        owner: root
        group: root
        mode: "0755"

    - name: Configure Docker storage driver for unprivileged LXC
      ansible.builtin.copy:
        dest: /etc/docker/daemon.json
        owner: root
        group: root
        mode: "0644"
        content: |
          {
            "storage-driver": "fuse-overlayfs"
          }
      register: docker_daemon_config

    - name: Ensure Docker service is enabled and running
      ansible.builtin.systemd:
        name: docker
        state: "{{ 'restarted' if docker_daemon_config.changed else 'started' }}"
        enabled: true

    - name: Ensure Vaultwarden data directory exists
      ansible.builtin.file:
        path: "{{ vaultwarden_data_dir }}"
        state: directory
        owner: root
        group: root
        mode: "0750"

    - name: Install Vaultwarden systemd unit
      ansible.builtin.copy:
        dest: /etc/systemd/system/vaultwarden.service
        owner: root
        group: root
        mode: "0644"
        content: |
          [Unit]
          Description=Vaultwarden container
          After=docker.service
          Requires=docker.service

          [Service]
          Restart=always
          RestartSec=10
          ExecStartPre=-/usr/bin/docker rm -f {{ vaultwarden_container_name }}
          ExecStart=/usr/bin/docker run --rm \
            --name {{ vaultwarden_container_name }} \
            --pull always \
            -p {{ vaultwarden_http_port }}:80 \
            -v {{ vaultwarden_data_dir }}:/data \
            -e WEBSOCKET_ENABLED=true \
            {{ vaultwarden_image }}
          ExecStop=/usr/bin/docker stop {{ vaultwarden_container_name }}

          [Install]
          WantedBy=multi-user.target
      register: vaultwarden_unit

    - name: Reload systemd when Vaultwarden unit changes
      ansible.builtin.systemd:
        daemon_reload: true
      when: vaultwarden_unit.changed

    - name: Enable and start Vaultwarden
      ansible.builtin.systemd:
        name: vaultwarden
        state: started
        enabled: true