Dmitry
66 lines
2.3 KiB
YAML
66 lines
2.3 KiB
YAML
- name: Configure Vaultwarden reverse proxy on ru-vps
|
|
hosts: ru-vps
|
|
gather_facts: false
|
|
vars:
|
|
caddy_dir: /opt/services/ru-vps/caddy
|
|
caddyfile_path: /opt/services/ru-vps/caddy/Caddyfile
|
|
vaultwarden_domain: pass.ada-dev.ru
|
|
vaultwarden_upstream: 192.168.1.24:80
|
|
|
|
tasks:
|
|
- name: Ensure Caddy service directory exists
|
|
ansible.builtin.file:
|
|
path: "{{ caddy_dir }}"
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
|
|
- name: Configure Vaultwarden Caddy site
|
|
ansible.builtin.blockinfile:
|
|
path: "{{ caddyfile_path }}"
|
|
create: true
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
marker: "# {mark} ANSIBLE MANAGED VAULTWARDEN SITE"
|
|
block: |
|
|
{{ vaultwarden_domain }} {
|
|
reverse_proxy {{ vaultwarden_upstream }}
|
|
}
|
|
register: vaultwarden_caddy_site
|
|
|
|
- name: Remove legacy unmanaged Vaultwarden Caddy site
|
|
ansible.builtin.replace:
|
|
path: "{{ caddyfile_path }}"
|
|
regexp: '(?ms)^pass\.ada-dev\.ru \{\n\s*reverse_proxy 10\.122\.62\.95:10380\n\}\n+'
|
|
replace: ''
|
|
register: vaultwarden_legacy_site
|
|
|
|
- name: Validate host Caddy config
|
|
ansible.builtin.command: caddy validate --config {{ caddyfile_path }}
|
|
changed_when: false
|
|
|
|
- name: Check Caddy container mounted config
|
|
ansible.builtin.command: docker exec caddy grep -F 'reverse_proxy {{ vaultwarden_upstream }}' /etc/caddy/Caddyfile
|
|
register: vaultwarden_container_caddyfile
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: Restart Caddy when config changed or bind mount is stale
|
|
ansible.builtin.command: docker restart caddy
|
|
when: >-
|
|
vaultwarden_caddy_site.changed or
|
|
vaultwarden_legacy_site.changed or
|
|
vaultwarden_container_caddyfile.rc != 0
|
|
|
|
- name: Validate Caddy container config after restart
|
|
ansible.builtin.command: docker exec caddy caddy validate --config /etc/caddy/Caddyfile
|
|
changed_when: false
|
|
|
|
- name: Check Vaultwarden upstream from ru-vps
|
|
ansible.builtin.command: curl -fsS -o /dev/null -w '%{http_code}' http://{{ vaultwarden_upstream }}/
|
|
register: vaultwarden_upstream_http
|
|
changed_when: false
|
|
failed_when: vaultwarden_upstream_http.stdout != '200'
|