infra/ansible/playbooks/pve-vaultwarden.yml

---
- name: Guard Vaultwarden VMID before API updates
  hosts: mini-pc
  gather_facts: false
  pre_tasks:
    - name: Skip legacy Vaultwarden provisioning for runtime-only calls
      ansible.builtin.meta: end_play
      when: not (pve_provisioning_enabled | default(true) | bool)
  tasks:
    - name: Read existing VMID 140 configuration
      ansible.builtin.command: pct config 140
      register: vaultwarden_existing_vmid
      changed_when: false
      failed_when: false

    - name: Refuse to modify a foreign VMID 140
      ansible.builtin.assert:
        that:
          - vaultwarden_existing_vmid.rc != 0 or vaultwarden_existing_hostname == 'vaultwarden'
        fail_msg: VMID 140 already exists and is not the Vaultwarden container.
      vars:
        vaultwarden_existing_hostname: >-
          {{ vaultwarden_existing_vmid.stdout_lines
             | select('match', '^hostname: ')
             | map('regex_replace', '^hostname: ', '')
             | first
             | default('') }}

- name: Create Vaultwarden LXC on mini-pc
  hosts: mini-pc
  gather_facts: false
  pre_tasks:
    - name: Skip legacy Vaultwarden provisioning for runtime-only calls
      ansible.builtin.meta: end_play
      when: not (pve_provisioning_enabled | default(true) | bool)
  vars:
    vaultwarden_vmid: 140
    vaultwarden_hostname: vaultwarden
    vaultwarden_ip: 192.168.1.24/24
    vaultwarden_gateway: 192.168.1.1
    vaultwarden_bridge: vmbr0
    vaultwarden_rootfs: local-lvm:16
    vaultwarden_ostemplate: local:vztmpl/debian-13-standard_13.1-2_amd64.tar.zst
    vaultwarden_pubkey_file: ~/.ssh/id_ed25519_homelab.pub
  handlers:
    - name: restart vaultwarden lxc
      ansible.builtin.shell: "pct stop {{ vaultwarden_vmid }} || true; pct start {{ vaultwarden_vmid }}"
      changed_when: true
  tasks:
    - name: Check if Vaultwarden LXC exists
      ansible.builtin.command: "pct config {{ vaultwarden_vmid }}"
      register: vaultwarden_pct_config
      changed_when: false
      failed_when: false

    - name: Install Vaultwarden LXC SSH public key on PVE host
      ansible.builtin.copy:
        dest: /tmp/vaultwarden-lxc.pub
        owner: root
        group: root
        mode: "0600"
        content: "{{ lookup('file', vaultwarden_pubkey_file) }}\n"
      when: vaultwarden_pct_config.rc != 0

    - name: Create Vaultwarden LXC
      ansible.builtin.command: >-
        pct create {{ vaultwarden_vmid }} {{ vaultwarden_ostemplate }}
        --hostname {{ vaultwarden_hostname }}
        --rootfs {{ vaultwarden_rootfs }}
        --cores 2
        --memory 1024
        --swap 512
        --net0 name=eth0,bridge={{ vaultwarden_bridge }},gw={{ vaultwarden_gateway }},ip={{ vaultwarden_ip }},firewall=1
        --nameserver 1.1.1.1
        --unprivileged 1
        --features nesting=1,keyctl=1
        --onboot 1
        --startup order=40
        --cmode shell
        --ssh-public-keys /tmp/vaultwarden-lxc.pub
      when: vaultwarden_pct_config.rc != 0

    - name: Start Vaultwarden LXC
      ansible.builtin.command: "pct start {{ vaultwarden_vmid }}"
      register: vaultwarden_pct_start
      changed_when: vaultwarden_pct_start.rc == 0
      failed_when: vaultwarden_pct_start.rc not in [0, 255]

    - name: Allow FUSE device in Vaultwarden LXC config
      ansible.builtin.lineinfile:
        path: "/etc/pve/lxc/{{ vaultwarden_vmid }}.conf"
        line: "lxc.cgroup2.devices.allow: c 10:229 rwm"
        state: present
      notify: restart vaultwarden lxc

    - name: Bind mount FUSE device in Vaultwarden LXC config
      ansible.builtin.lineinfile:
        path: "/etc/pve/lxc/{{ vaultwarden_vmid }}.conf"
        line: "lxc.mount.entry: /dev/fuse dev/fuse none bind,create=file"
        state: present
      notify: restart vaultwarden lxc

    - name: Apply pending LXC config changes
      ansible.builtin.meta: flush_handlers

    - name: Wait for Vaultwarden SSH through ru-vps
      ansible.builtin.wait_for_connection:
        timeout: 120
      delegate_to: vaultwarden
      vars:
        ansible_become: false

- name: Configure Docker and Vaultwarden inside LXC
  # Таргет переопределяем ради blue-green переезда на OpenTofu: во время
  # миграции этот play нужно прогнать против нового контейнера на временном
  # адресе. Просто `--limit vaultwarden-new` для этого НЕ годится — лимит
  # пересекается с паттерном play и даёт ноль хостов, а не перенацеливание
  # (проверено 2026-09-02 через --list-hosts на всех плейбуках).
  # Использовать вместе с --limit, чтобы play создания контейнера отсеялся:
  #   ansible-playbook playbooks/pve-vaultwarden.yml \
  #     -e pve_config_target=vaultwarden-new --limit vaultwarden-new
  # По умолчанию поведение не меняется.
  hosts: "{{ pve_config_target | default('vaultwarden') }}"
  gather_facts: true
  vars:
    ansible_become: false
    vaultwarden_data_dir: /opt/vaultwarden/data
    vaultwarden_image: vaultwarden/server:1.37.1@sha256:e9efdf001bf0d68c21f2cbfb8e1d9b5961a7ca9c85e0a7e58bf51a13b997d744
    vaultwarden_container_name: vaultwarden
    vaultwarden_http_port: 80
  tasks:
    - name: Install Docker packages
      ansible.builtin.apt:
        name:
          - docker.io
          - fuse-overlayfs
          - sqlite3
          - ca-certificates
          - curl
        state: present
        update_cache: true

    - name: Ensure Docker config directory exists
      ansible.builtin.file:
        path: /etc/docker
        state: directory
        owner: root
        group: root
        mode: "0755"

    - name: Configure Docker storage driver for unprivileged LXC
      ansible.builtin.copy:
        dest: /etc/docker/daemon.json
        owner: root
        group: root
        mode: "0644"
        content: |
          {
            "storage-driver": "fuse-overlayfs"
          }
      register: docker_daemon_config

    - name: Ensure Docker service is enabled and running
      ansible.builtin.systemd:
        name: docker
        state: "{{ 'restarted' if docker_daemon_config.changed else 'started' }}"
        enabled: true

    - name: Ensure Vaultwarden data directory exists
      ansible.builtin.file:
        path: "{{ vaultwarden_data_dir }}"
        state: directory
        owner: root
        group: root
        mode: "0750"

    - name: Check if the configured Vaultwarden image is present
      ansible.builtin.command: "docker image inspect {{ vaultwarden_image }}"
      register: vaultwarden_image_inspect
      changed_when: false
      failed_when: false

    - name: Pull the configured Vaultwarden image
      ansible.builtin.command: "docker pull {{ vaultwarden_image }}"
      when: vaultwarden_image_inspect.rc != 0
      register: vaultwarden_image_pull
      changed_when: true

    - name: Install Vaultwarden systemd unit
      ansible.builtin.copy:
        dest: /etc/systemd/system/vaultwarden.service
        owner: root
        group: root
        mode: "0644"
        content: |
          [Unit]
          Description=Vaultwarden container
          After=docker.service
          Requires=docker.service

          [Service]
          Restart=always
          RestartSec=10
          ExecStartPre=-/usr/bin/docker rm -f {{ vaultwarden_container_name }}
          ExecStart=/usr/bin/docker run --rm \
            --name {{ vaultwarden_container_name }} \
            --pull never \
            -p {{ vaultwarden_http_port }}:80 \
            -v {{ vaultwarden_data_dir }}:/data \
            -e WEBSOCKET_ENABLED=true \
            {{ vaultwarden_image }}
          ExecStop=/usr/bin/docker stop {{ vaultwarden_container_name }}

          [Install]
          WantedBy=multi-user.target
      register: vaultwarden_unit

    - name: Reload systemd when Vaultwarden unit changes
      ansible.builtin.systemd:
        daemon_reload: true
      when: vaultwarden_unit.changed

    - name: Enable and start Vaultwarden
      ansible.builtin.systemd:
        name: vaultwarden
        state: "{{ 'restarted' if vaultwarden_unit.changed or vaultwarden_image_pull.changed else 'started' }}"
        enabled: true

    - name: Wait for Vaultwarden HTTP endpoint
      ansible.builtin.uri:
        url: "http://127.0.0.1:{{ vaultwarden_http_port }}/"
        status_code: 200
      register: vaultwarden_health
      retries: 24
      delay: 5
      until: vaultwarden_health.status == 200

    - name: Verify Docker storage driver
      ansible.builtin.command: docker info --format '{{ "{{" }}.Driver{{ "}}" }}'
      register: vaultwarden_docker_driver
      changed_when: false
      failed_when: vaultwarden_docker_driver.stdout != 'fuse-overlayfs'