personal_infra/ansible/services/vaultwarden/deploy_vaultwarden_playbook.yml

- name: Deploy Vaultwarden with Docker Compose and configure Caddy reverse proxy
  hosts: edge
  become: yes
  vars_files:
    - ./vaultwarden_vars.yml
  vars:
    vaultwarden_subdomain: "{{ subdomains.vaultwarden }}"
    vaultwarden_domain: "{{ vaultwarden_subdomain }}.{{ root_domain }}"

  tasks:
    - name: Create vaultwarden directory
      file:
        path: "{{ vaultwarden_dir }}"
        state: directory
        owner: "{{ ansible_user }}"
        group: "{{ ansible_user }}"
        mode: '0755'

    - name: Create docker-compose.yml for vaultwarden
      copy:
        dest: "{{ vaultwarden_dir }}/docker-compose.yml"
        content: |
          version: "3"
          services:
            vaultwarden:
              image: vaultwarden/server:latest
              container_name: vaultwarden
              restart: unless-stopped
              ports:
                - "{{ vaultwarden_port }}:80"
              volumes:
                - ./data:/data
              environment:
                WEBSOCKET_ENABLED: 'true'
                DOMAIN: "https://{{ vaultwarden_domain }}"
                SIGNUPS_ALLOWED: 'true'
                LOG_FILE: /data/vaultwarden.log

    - name: Deploy vaultwarden container with docker compose
      command: docker compose up -d
      args:
        chdir: "{{ vaultwarden_dir }}"

    - name: Create Fail2Ban filter for Vaultwarden
      copy:
        dest: /etc/fail2ban/filter.d/vaultwarden.local
        owner: root
        group: root
        mode: '0644'
        content: |
          [INCLUDES]
          before = common.conf

          [Definition]
          failregex = ^.*?Username or password is incorrect\. Try again\. IP: <ADDR>\. Username:.*$
          ignoreregex =

    - name: Create Fail2Ban jail for Vaultwarden
      copy:
        dest: /etc/fail2ban/jail.d/vaultwarden.local
        owner: root
        group: root
        mode: '0644'
        content: |
          [vaultwarden]
          enabled = true
          port = http,https
          filter = vaultwarden
          logpath = {{ vaultwarden_data_dir }}/vaultwarden.log
          maxretry = 10
          findtime = 10m
          bantime = 1h

    - name: Restart fail2ban to apply changes
      systemd:
        name: fail2ban
        state: restarted

    - name: Publish Vaultwarden through Caddy
      ansible.builtin.include_role:
        name: caddy_site
      vars:
        caddy_site_name: vaultwarden
        caddy_site_domain: "{{ vaultwarden_domain }}"
        caddy_site_upstream: "localhost:{{ vaultwarden_port }}"