tanshu
476a6d7cd0
Comment blocks now stay within three lines and explain only the non-obvious. Long histories, include examples, and commented-out code are gone. No task, key, or value changed; the only data change is comment text inside the generated unit files.
51 lines
2.0 KiB
YAML
51 lines
2.0 KiB
YAML
---
|
|
# Duplicated from caddy/vars/default.yml on purpose, so keep them in sync.
|
|
# podman_user comes from the connection user, so the play needs gather_facts.
|
|
podman_user: "{{ ansible_facts['user_id'] }}"
|
|
podman_data_dir: "{{ ansible_facts['user_dir'] }}/podman-data"
|
|
quadlet_dir: "{{ ansible_facts['user_dir'] }}/.config/containers/systemd"
|
|
|
|
# The service keeps the Docker-era name everywhere. Only the image is vaultwarden/server.
|
|
host: vault.tanshu.com
|
|
|
|
container_name: bitwarden
|
|
unit_name: "{{ container_name }}.service"
|
|
|
|
# Fully qualified because rootless Podman would otherwise prompt for a registry, and a unit has no TTY.
|
|
image: docker.io/vaultwarden/server:latest
|
|
|
|
# caddy/roles/register pins the Podman network to <network_name>_net, so the Quadlet file is bitwarden.network.
|
|
network_name: "{{ container_name }}"
|
|
|
|
host_directory: "{{ podman_data_dir }}/{{ container_name }}"
|
|
|
|
# The image's VOLUME is /data and ROCKET_PORT is 80, so this is the bind mount target and the proxied port.
|
|
data_dir: "{{ host_directory }}/data"
|
|
container_port: 80
|
|
|
|
# DATABASE_URL carries the Postgres password, so keep it in this 0600 file that systemd reads.
|
|
env_file: "{{ host_directory }}/bitwarden.env"
|
|
|
|
postgres_container: postgres
|
|
postgres_unit: "{{ postgres_container }}.service"
|
|
|
|
# Kept as-is so the restored database and the app's connection string agree.
|
|
pg_user: postgres
|
|
pg_password: '123456'
|
|
pg_database: bitwarden
|
|
|
|
# A hostname, not an IP: postgres/roles/attach joins the container to bitwarden_net, which makes it resolve.
|
|
database_url: "postgresql://{{ pg_user }}:{{ pg_password }}@{{ postgres_container }}:5432/{{ pg_database }}"
|
|
|
|
# Vaultwarden requires a scheme here and builds its web vault and API links from it.
|
|
domain: "https://{{ host }}"
|
|
|
|
caddy_name: caddy
|
|
caddyfile_path: "{{ podman_data_dir }}/{{ caddy_name }}/conf/Caddyfile"
|
|
|
|
# Caddy streams request bodies with no limit by default, so there is no client_max_body_size equivalent.
|
|
snippet_block: |
|
|
{{ host }} {
|
|
reverse_proxy {{ container_name }}:{{ container_port }}
|
|
}
|