install-bitwarden-part-1.yml

---
- name: Install basic BitWarden on server with https, no SSO config.
  hosts: grpbitwarden
  remote_user: root


  # Playbook to install bitwarden password server package on host.
  # Execute: ansible-playbook install-bitwarden-sso.yml -i hosts --vault-password-file .vault-password

  vars:
    root_ca_path: /usr/local/share/ca-certificates/mkcert_development_CA_62268663181785622328732999788222374785.crt
    bitwarden_client_id: "client-bitwarden-{{ ansible_fqdn }}"
    bitwarden_client_name: "client-bitwarden-{{ ansible_fqdn }}"
    bitwarden_server_url: https://password.{{ domain }}
    keycloak_server_url: https://ad.{{ domain }}

  tasks:
    - name: Test connection to host
      ansible.builtin.ping:

    - name: Read global vars
      ansible.builtin.include_vars: global-vars.yml

    - name: Read encrypted content
      ansible.builtin.include_vars: encrypted-vars.yml

    - name: Set timezone to Europe/Amsterdam
      community.general.timezone:
        name: Europe/Amsterdam

    # Add docker key
    # curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -
    - name: Add docker key
      ansible.builtin.apt_key:
        url: https://download.docker.com/linux/ubuntu/gpg
        state: present

    # Add docker repo
    # sudo add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable"
    - name: Add docker repo
      ansible.builtin.command:
        cmd: add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable"
      register: my_output # <- Registers the command output.
      changed_when: my_output.rc != 0 # <- Uses the return code to define when the task has changed.

    #
    # apt update
    # sudo apt-get install apt-transport-https ca-certificates curl gnupg-agent software-properties-common
    # sudo apt install docker-ce docker-ce-cli containerd.io docker-compose
    - name: Install needed packages
      ansible.builtin.apt:
        name: "{{ item }}"
        state: present
      loop:
        - apt-transport-https
        - ca-certificates
        - curl
        - gnupg-agent
        - software-properties-common
        - docker-ce
        - docker-ce-cli
        - containerd.io
        - docker-compose
        - python3-pexpect
        - unzip


    # Create a user to run Bitwarden. Use bash as the default terminal and /opt/bitwarden as the home directory.

    # $ sudo useradd -s /bin/bash -d /opt/bitwarden bitwarden
    #  Add user bitwarden to group docker so it can access Docker.
    # $ sudo mkdir -p /opt/bitwarden
    - name: Create a user to run Bitwarden.
      ansible.builtin.user:
        name: bitwarden
        shell: /bin/bash
        home: /opt/bitwarden
        groups: docker

    # Make dir for SSL keys
    - name: Make SSL dir for keys
      become: true
      become_user: bitwarden
      ansible.builtin.command:
        cmd: "mkdir -p /opt/bitwarden/bwdata/ssl/self/{{ ansible_fqdn }}"
      register: my_output # <- Registers the command output.
      changed_when: my_output.rc != 0 # <- Uses the return code to define when the task has changed.

    # - name: Copy SSL key and cert to "/etc/nginx/ssl/self/{{ ansible_fqdn }}" for later use
    #   copy:
    #     src: "files/{{ item }}"
    #     dest: "/etc/nginx/ssl/self/{{ ansible_fqdn }}/{{ item }}"
    #     owner: bitwarden
    #     group: bitwarden
    #     mode: '0600'
    #   loop:
    #     - _wildcard.{{ domain }}.pem
    #     - _wildcard.{{ domain }}-key.pem

    # $ sudo chown bitwarden: /opt/bitwarden
    # $ sudo chmod 700 /opt/bitwarden

    # Switch to the new user.
    # $ sudo su - bitwarden
    # 2. Install Bitwarden Server
    # Download the official Bitwarden deployment script:
    # $ wget -O bitwarden.sh https://go.btwrdn.co/bw-sh
    # $ chmod +x bitwarden.sh
    - name: Download bitwarden install script in homedir of bitwarden user
      ansible.builtin.get_url:
        url: https://go.btwrdn.co/bw-sh
        dest: /opt/bitwarden/bitwarden.sh
        owner: bitwarden
        group: bitwarden
        mode: '0755'

    # Check if /opt/bitwarden/bwdata/ exists
    - name: Check if /opt/bitwarden/bwdata/ already exists
      ansible.builtin.stat:
        path: "/opt/bitwarden/bwdata/"
      register: bwdata_dir_stat

    - name: Is /opt/bitwarden/bwdata/ already present?
      ansible.builtin.debug:
        msg: "/opt/bitwarden/bwdata/ already present"
      when: bwdata_dir_stat.stat.exists

    - name: Download extra Bitwarden CLI tool
      ansible.builtin.get_url:
        url: "https://vault.bitwarden.com/download/?app=cli&platform=linux"
        dest: /tmp/bw-cli.zip
        owner: bitwarden
        group: bitwarden
        mode: '0644'

    - name: Unpack Bitwarden CLI tool
      ansible.builtin.unarchive:
        src: "/tmp/bw-cli.zip"
        dest: /opt/bitwarden
        owner: bitwarden
        group: bitwarden
        remote_src: true

    - name: Make Bitwarden CLI tool executable
      ansible.builtin.file:
        path: /opt/bitwarden/bw
        owner: bitwarden
        group: bitwarden
        mode: '0755'


    # If not present we now need to run the install script.
    # $ ./bitwarden.sh install
    #
    # Use the form at https://bitwarden.com/host/ to request your private Installation Id and Installation Key for self-hosting Bitwarden.
    # The Installation Id and Key are applied during installation of your Bitwarden instance and stored here: ./bwdata/env/global.override.env 
    # You should use a unique id and key for each Bitwarden installation.
    # INSTALLATION ID: 8c7729c8-a13e-4110-ae36-ae52008c2724
    # INSTALLATION KEY: oslnBjE2l0WtcEvD9VcJ
    # Run the install script
    #  _     _ _                         _
    # | |__ (_) |___      ____ _ _ __ __| | ___ _ __
    # | '_ \| | __\ \ /\ / / _` | '__/ _` |/ _ \ '_ \
    # | |_) | | |_ \ V  V / (_| | | | (_| |  __/ | | |
    # |_.__/|_|\__| \_/\_/ \__,_|_|  \__,_|\___|_| |_|
    #
    # Open source password management solutions
    # Copyright 2015-2022, 8bit Solutions LLC
    # https://bitwarden.com, https://github.com/bitwarden
    #
    # ===================================================
    #
    # bitwarden.sh version 2022.8.4
    # Docker version 20.10.17, build 100c701
    # docker-compose version 1.25.0, build unknown
    #
    # (!) Enter the domain name for your Bitwarden instance (ex. bitwarden.example.com): password.{{ domain }}
    #
    # (!) Do you want to use Let's Encrypt to generate a free SSL certificate? (y/n): n
    #
    # (!) Enter the database name for your Bitwarden instance (ex. vault): vault
    #
    # 2022.8.4: Pulling from bitwarden/setup
    # 1efc276f4ff9: Pull complete
    # e5aeae5c9ad4: Pull complete
    # 9d8b4edc672a: Pull complete
    # 67bb3a123350: Pull complete
    # 4b31f33ff8ee: Pull complete
    # 8302c6d93c2f: Pull complete
    # 64c1ff0e03a3: Pull complete
    # 289e8b648bb1: Pull complete
    # c706fe453135: Pull complete
    # 6b18bfe90415: Pull complete
    # Digest: sha256:257317606bad7b6c06755c81e4f61099b4af8b89829d7a9a2688545b92daa45f
    # Status: Downloaded newer image for bitwarden/setup:2022.8.4
    # docker.io/bitwarden/setup:2022.8.4
    #
    # (!) Enter your installation id (get at https://bitwarden.com/host): 8c7729c8-a13e-4110-ae36-ae52008c2724
    #
    # (!) Enter your installation key: oslnBjE2l0WtcEvD9VcJ
    #
    # (!) Do you have a SSL certificate to use? (y/n): y
    #
    # !!!!!!!!!! NOTE !!!!!!!!!!
    # Make sure 'certificate.crt' and 'private.key' are provided in the
    # appropriate directory before running 'start' (see docs for info).
    #
    # (!) Is this a trusted SSL certificate (requires ca.crt, see docs)? (y/n): y
    #
    # Generating key for IdentityServer.
    # Generating a RSA private key
    # ...................................................................................++++
    # .................++++
    # writing new private key to 'identity.key'
    # -----
    #
    # Building nginx config.
    # Building docker environment files.
    # Building docker environment override files.
    # Building FIDO U2F app id.
    # Building docker-compose.yml.
    #
    # Installation complete
    #
    # If you need to make additional configuration changes, you can modify
    # the settings in `./bwdata/config.yml` and then run:
    # `./bitwarden.sh rebuild` or `./bitwarden.sh update`
    #
    # Next steps, run:
    # `./bitwarden.sh start`
    - name: Run the install script
      become: true
      become_user: bitwarden
      ansible.builtin.expect:
        command: /opt/bitwarden/bitwarden.sh install
        chdir: /opt/bitwarden
        timeout: 120
        echo: true
        responses:
          "Enter the domain name for your Bitwarden instance": "{{ ansible_fqdn }}"
          "Do you want to use Let's Encrypt to generate a free SSL certificate": n
          "Enter the database name for your Bitwarden instance": vault
          "Enter your installation id": "{{ bitwarden_installation_id }}"
          "Enter your installation key": "{{ bitwarden_installation_key }}"
          "Do you have a SSL certificate to use": y
          "Is this a trusted SSL certificate": y
      ignore_errors: "{{ ansible_check_mode }}" # <- Ignores errors in check mode.

    # Make dir for BitWarden SSL keys
    - name: Make SSL dir for keys
      become: true
      become_user: bitwarden
      ansible.builtin.command:
        cmd: "mkdir -p /opt/bitwarden/bwdata/ssl/self/{{ ansible_fqdn }}"
      register: my_output # <- Registers the command output.
      changed_when: my_output.rc != 0 # <- Uses the return code to define when the task has changed.

    # Use an Existing SSL Certificate
    #
    # You may alternatively opt to use an existing SSL Certificate, which will
    # require you to have the following files:
    #
    #    A Server Certificate (certificate.crt)
    #    A Private Key (private.key)
    #    A CA Certificate (ca.crt)
    #
    # You may need to bundle your primary certificate with Intermediate CA
    # certificates to prevent SSL trust errors. All certificates should be
    # included in the Server Certificate file when using a CA Certificate. The
    # first certificate in the file should be your Server Certificate, followed by
    # any Intermediate CA certificate(s), followed by the Root CA.
    #
    # Under the default configuration, place your files in
    # ./bwdata/ssl/your.domain. You may specify a different location for your
    # certificate files by editing the following values in ./bwdata/config.yml:
    #
    # ssl_certificate_path: <path>
    # ssl_key_path: <path>
    # ssl_ca_path: <path>
    #
    # Make sure SSL filenames are correct
    # ssl_certificate_path: /etc/ssl/self/password.{{ domain }}/certificate.crt
    # Note: Path uses the container's ssl directory. The `./ssl` host directory is mapped to
    # `/etc/ssl` within the container.
    # ssl_key_path: /etc/ssl/self/password.{{ domain }}/private.key
    # Note: Path uses the container's ssl directory. The `./ssl` host directory is mapped to
    # `/etc/ssl` within the container.
    # ssl_ca_path:
    # Note: Path uses the container's ssl directory. The `./ssl` host directory is mapped to
    - name: Copy current SSL cert to correct directory ("/bwdata/ssl/{{ ansible_fqdn }}/"
      become: true
      become_user: bitwarden
      ansible.builtin.copy:
        src: "files/_wildcard.{{ domain }}.pem"
        dest: "/opt/bitwarden/bwdata/ssl/{{ ansible_fqdn }}/certificate.crt"
        mode: '0600'

    - name: Show path to certificate
      ansible.builtin.debug:
        msg: "/opt/bitwarden/bwdata/ssl/{{ ansible_fqdn }}/certificate.crt"

  # Bitwarden NGINX borkt hierop
  # - name: Append current CA to certificate
  #   shell:
  #     cmd: cat "{{ root_ca_path }}" >> "/opt/bitwarden/bwdata/ssl/{{ ansible_fqdn }}/certificate.crt"

    - name: Copy current SSL key to correct directory "bwdata/ssl/{{ ansible_fqdn }}/"
      become: true
      become_user: bitwarden
      ansible.builtin.copy:
        src: "files/_wildcard.{{ domain }}-key.pem"
        dest: "/opt/bitwarden/bwdata/ssl/{{ ansible_fqdn }}/private.key"
        mode: '0600'

    - name: Show path to private key
      ansible.builtin.debug:
        msg: "/opt/bitwarden/bwdata/ssl/{{ ansible_fqdn }}/private.key"

    - name: Copy CA certificate file key to correct directory
      become: true
      become_user: bitwarden
      ansible.builtin.copy:
        src: "{{ root_ca_path }}"
        remote_src: true
        dest: "/opt/bitwarden/bwdata/ssl/{{ ansible_fqdn }}/ca.crt"
        mode: '0600'

    - name: Show path to ca certificate
      ansible.builtin.debug:
        msg: "/opt/bitwarden/bwdata/ssl/{{ ansible_fqdn }}/ca.crt"

    # TODO Next steps, run:
    # `./bitwarden.sh start`
    # 3. Configure the Environment
    # Run ./bitwarden.sh start to start the Bitwarden Server.
    # Note: Some Bitwarden features are not configured by the bitwarden.sh installer, and must be configured in the environment file,
    #       located at ./bwdata/env/global.override.env. At a minimum, you should configure:
    # ...
    # globalSettings__mail__smtp__host=<placeholder>
    # globalSettings__mail__smtp__port=<placeholder>
    # globalSettings__mail__smtp__ssl=<placeholder>
    # globalSettings__mail__smtp__username=<placeholder>
    # globalSettings__mail__smtp__password=<placeholder>
    # ...
    # adminSettings__admins=

    # If you need to make additional configuration changes, you can modify
    # the settings in `./bwdata/config.yml` and then run:
    # `./bitwarden.sh rebuild` or `./bitwarden.sh update`
    - name: Implement changes in config files
      become: true
      become_user: bitwarden
      ansible.builtin.command:
        chdir: /opt/bitwarden
        cmd: /opt/bitwarden/bitwarden.sh rebuild
      register: my_output # <- Registers the command output.
      changed_when: my_output.rc != 0 # <- Uses the return code to define when the task has changed.


    # Run the following command to apply your changes:
    # ./bitwarden.sh restart
    - name: Restart all bitwarden services
      become: true
      become_user: bitwarden
      ansible.builtin.command:
        chdir: /opt/bitwarden
        cmd: /opt/bitwarden/bitwarden.sh restart
      register: my_output # <- Registers the command output.
      changed_when: my_output.rc != 0 # <- Uses the return code to define when the task has changed.


    ############################################################################################
    # Also this needs to be fixed.
    # DO NOT EVER USE THE PIECE OF CRAP Bitwarden Directory Connector to sync users from ldap
    ############################################################################################
    # SAML SSO: https://bitwarden.com/help/configure-sso-saml/

    - name: Show post-install message
      ansible.builtin.debug:
        msg: |
          * Now go to URL "{{ bitwarden_server_url }}"
          * Create a master user account.
          * Go to "Settings" and add an organization using "+New Organization" link.
          * Upload the Bitwarden license file for your organization.
          * Go to the "Organizations" menu and open the "Settings" menu.
          * Click on the "View API Key" button, enter your password and copy the "client_id" .
          * Insert these into the next Bitwarden playbook as environment settings on the command line as follows;
          * $ ansible-playbook install-bitwarden-part-2-saml-sso.yml -e client_id="your-client_id" .
          * Please continue to the SAML playbook for bitwarden called "install-bitwarden-part-2-saml-sso.yml".
          * We are done here.
          ****************************************************************************************