counterweight
751277f0c2
SIGNUPS_ALLOWED was hardcoded 'true' in the compose file and turned off by a separate manual playbook, so every routine run of the deploy - site.yml included - silently re-opened registration. It is now vaultwarden_signups_allowed, default false. The port was published as a bare "8222:80". Docker writes its own iptables rules ahead of UFW, so Vaultwarden answered plain HTTP on the public interface, bypassing Caddy and TLS. Now 127.0.0.1:8222; verified closed from outside. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
21 lines
1,003 B
YAML
21 lines
1,003 B
YAML
# General
|
|
vaultwarden_dir: /opt/vaultwarden
|
|
vaultwarden_data_dir: "{{ vaultwarden_dir }}/data"
|
|
vaultwarden_port: 8222
|
|
|
|
# Public registration. OFF: the accounts exist, and this vault is on the open
|
|
# internet. It used to be hardcoded 'true' in the compose file and turned off by
|
|
# a separate manual playbook - so every routine run of the deploy (site.yml
|
|
# included) silently re-opened sign-ups. Flip to true only to add an account,
|
|
# then back.
|
|
vaultwarden_signups_allowed: false
|
|
|
|
# (subdomain in group_vars/all/main.yml, caddy_sites_dir in roles/caddy_site/defaults/)
|
|
|
|
# Remote access
|
|
remote_host_name: "{{ groups['edge'] | first }}"
|
|
remote_host: "{{ hostvars.get(remote_host_name, {}).get('ansible_host', remote_host_name) }}"
|
|
remote_user: "{{ hostvars.get(remote_host_name, {}).get('ansible_user', 'counterweight') }}"
|
|
remote_key_file: "{{ hostvars.get(remote_host_name, {}).get('ansible_ssh_private_key_file', '') }}"
|
|
remote_port: "{{ hostvars.get(remote_host_name, {}).get('ansible_port', 22) }}"
|
|
|