Merge branch 'work' into 'main'

Work

See merge request kdam0/home-lab!1

20 files changed, 640 insertions, 0 deletions

diff --git a/ansible/roles/base/tasks/main.yaml b/ansible/roles/base/tasks/main.yaml
new file mode 100644
index 0000000..b5aaf97
--- /dev/null
+++ b/ansible/roles/base/tasks/main.yaml
@@ -0,0 +1,12 @@
+---
+
+- tags: 'always'
+  # noqa: name[missing]
+  block:
+    - name: 'Install some useful packages'
+      ansible.builtin.apt:
+        name:
+          - 'tcpdump'
+          - 'curl'
+        state: 'present'
+        update_cache: true
diff --git a/ansible/roles/caddy_add/tasks/main.yaml b/ansible/roles/caddy_add/tasks/main.yaml
new file mode 100644
index 0000000..80382d4
--- /dev/null
+++ b/ansible/roles/caddy_add/tasks/main.yaml
@@ -0,0 +1,64 @@
+---
+
+- tags: 'always'
+  # noqa: name[missing]
+  block:
+    - name: 'Ensure required vars are set'
+      ansible.builtin.assert:
+        that:
+          - item | mandatory
+      loop:
+        - '{{ caddy_add_hosts }}'
+        - '{{ caddy_add_upstream_host }}'
+        - '{{ caddy_add_upstream_port }}'
+
+    - name: 'Call the Caddy API to add our new host'
+      ansible.builtin.uri:
+        url: 'http://rproxy:2019/config/apps/http/servers/serv0/routes'
+        method: 'PUT'
+        body_format: 'json'
+        status_code: 200
+        body: |
+          {
+            "match": [
+              {
+                "host": {{ caddy_add_hosts | to_json }}
+              }
+            ],
+            "handle": [
+              {
+                "handler": "subroute",
+                "routes": [
+                  {
+                    "handle": [
+                      {
+                        "handler": "reverse_proxy",
+                        "upstreams": [
+                          {
+                            "dial": "{{ caddy_add_upstream_host }}:{{ caddy_add_upstream_port }}"
+                          }
+                        ]
+                      }
+                    ]
+                  }
+                ]
+              }
+            ],
+            "terminal": true
+          }
+
+    - name: 'Get a copy of the new Caddy config'
+      delegate_to: 'localhost'
+      ansible.builtin.uri:
+        url: 'http://rproxy:2019/config'
+        return_content: true
+      register: '_current_conf'
+
+    - name: 'Save the new config to file'
+      delegate_to: 'localhost'
+      ansible.builtin.copy:
+        dest: 'artifacts/caddy/{{ _file_name }}'
+        content: '{{ _current_conf.json }}'
+        mode: '644'
+      vars:
+        _file_name: 'v{{ lookup("pipe", "date +%Y%m%dT%H%M%S") }}.json'
diff --git a/ansible/roles/docker/tasks/main.yaml b/ansible/roles/docker/tasks/main.yaml
new file mode 100644
index 0000000..bb5b55b
--- /dev/null
+++ b/ansible/roles/docker/tasks/main.yaml
@@ -0,0 +1,34 @@
+---
+
+- tags: 'always'
+  # noqa: name[missing]
+  block:
+    - name: 'Install some prereqs'
+      ansible.builtin.package:
+        name:
+          - 'ca-certificates'
+          - 'gnupg'
+        state: 'present'
+
+    - name: 'Run Docker installer'
+      ansible.builtin.shell:
+        cmd: |
+          curl -fsSL https://get.docker.com | sh
+        creates: '/var/run/docker.sock'
+
+    - name: 'Docker set MTU'
+      ansible.builtin.copy:
+        dest: '/etc/docker/daemon.json'
+        content: |
+          {"mtu": 1420}
+        mode: '644'
+
+    - name: 'Restart Docker service'
+      ansible.builtin.service:
+        name: 'docker'
+        state: 'restarted'
+
+    - name: 'Install docker-compose'
+      ansible.builtin.package:
+        name: 'docker-compose'
+        state: 'present'
diff --git a/ansible/roles/med_dl/tasks/main.yaml b/ansible/roles/med_dl/tasks/main.yaml
new file mode 100644
index 0000000..c4d4a7f
--- /dev/null
+++ b/ansible/roles/med_dl/tasks/main.yaml
@@ -0,0 +1,5 @@
+---
+
+- name: 'Run the setup tasks'
+  ansible.builtin.import_tasks: 'setup.yaml'
+  tags: 'med_dl'
diff --git a/ansible/roles/med_dl/tasks/setup.yaml b/ansible/roles/med_dl/tasks/setup.yaml
new file mode 100644
index 0000000..46affac
--- /dev/null
+++ b/ansible/roles/med_dl/tasks/setup.yaml
@@ -0,0 +1,38 @@
+---
+
+- name: 'setup | Ensure required vars are set'
+  ansible.builtin.assert:
+    that:
+      - item | mandatory
+  loop:
+    - '{{ med_dl_nas_mount_path }}'
+  no_log: true
+
+- name: 'setup | Install required pkgs'
+  ansible.builtin.package:
+    name:
+      - 'nfs-common'
+
+- name: 'setup | Create the mount dir'
+  ansible.builtin.file:
+    path: '/mnt/data'
+    state: 'directory'
+    mode: '755'
+
+- name: 'setup | Setup the NFS mount'
+  ansible.posix.mount:
+    src: '{{ med_dl_nas_mount_path }}'
+    path: '/mnt/data'
+    state: 'mounted'
+    fstype: 'nfs'
+
+- name: 'setup | Copy the docker-compose file'
+  ansible.builtin.template:
+    src: 'docker-compose.yaml.j2'
+    dest: 'docker-compose.yaml'
+    mode: '644'
+
+- name: 'setup | Start the service'
+  ansible.builtin.command: 'docker-compose up -d'
+  register: '_compose_up_cmd'
+  changed_when: '_compose_up_cmd.rc == 0'
diff --git a/ansible/roles/med_dl/templates/docker-compose.yaml.j2 b/ansible/roles/med_dl/templates/docker-compose.yaml.j2
new file mode 100644
index 0000000..fa25db0
--- /dev/null
+++ b/ansible/roles/med_dl/templates/docker-compose.yaml.j2
@@ -0,0 +1,67 @@
+{{ ansible_managed | comment }}
+version: "3"
+services:
+  prowlarr:
+    image: lscr.io/linuxserver/prowlarr:latest
+    restart: unless-stopped
+    container_name: prowlarr
+    volumes:
+      - prowlarr-config:/config
+    ports:
+      - 9696:9696
+    environment:
+      - PUID=1001
+      - PGID=1001
+      - TZ=Etc/UTC
+    networks:
+    - med-dl
+
+  radarr:
+    image: lscr.io/linuxserver/radarr:latest
+    restart: unless-stopped
+    container_name: radarr
+    volumes:
+      - radarr-config:/config
+      - /mnt/data/downloads:/mnt/data/downloads
+      - /mnt/data/mov:/mov
+    ports:
+      - 7878:7878
+    environment:
+      - PUID=1001
+      - PGID=1001
+      - TZ=Etc/UTC
+    networks:
+    - med-dl
+
+  sonarr:
+    image: lscr.io/linuxserver/sonarr:latest
+    restart: unless-stopped
+    container_name: sonarr
+    volumes:
+      - sonarr-config:/config
+      - /mnt/data/downloads:/mnt/data/downloads
+      - /mnt/data/tv:/tv
+    ports:
+      - 8989:8989
+    environment:
+      - PUID=1001
+      - PGID=1001
+      - TZ=Etc/UTC
+    networks:
+    - med-dl
+
+volumes:
+  prowlarr-config:
+    name: prowlarr-config
+  radarr-config:
+    name: radarr-config
+  sonarr-config:
+    name: sonarr-config
+
+networks:
+  med-dl:
+    name: med-dl
+    driver: bridge
+    driver_opts:                         
+      com.docker.network.driver.mtu: 1420
+
diff --git a/ansible/roles/monitoring/tasks/main.yaml b/ansible/roles/monitoring/tasks/main.yaml
new file mode 100644
index 0000000..256a09f
--- /dev/null
+++ b/ansible/roles/monitoring/tasks/main.yaml
@@ -0,0 +1,5 @@
+---
+
+- name: 'Run the setup tasks'
+  ansible.builtin.import_tasks: 'setup.yaml'
+  tags: 'monitoring'
diff --git a/ansible/roles/monitoring/tasks/setup.yaml b/ansible/roles/monitoring/tasks/setup.yaml
new file mode 100644
index 0000000..824d2db
--- /dev/null
+++ b/ansible/roles/monitoring/tasks/setup.yaml
@@ -0,0 +1,20 @@
+---
+
+- name: 'setup | Install required pkgs'
+  ansible.builtin.package:
+    name:
+      - 'prometheus'
+      - 'prometheus-node-exporter'
+      - 'prometheus-blackbox-exporter'
+
+- name: 'setup | Set the Prom config'
+  ansible.builtin.template:
+    src: 'prometheus.yml.j2'
+    dest: '/etc/prometheus/prometheus.yml'
+    mode: '644'
+
+- name: 'setup | Start the service'
+  ansible.builtin.service:
+    name: 'prometheus'
+    state: 'restarted'
+    enabled: true
diff --git a/ansible/roles/monitoring/templates/prometheus.yml.j2 b/ansible/roles/monitoring/templates/prometheus.yml.j2
new file mode 100644
index 0000000..a5f3b46
--- /dev/null
+++ b/ansible/roles/monitoring/templates/prometheus.yml.j2
@@ -0,0 +1,47 @@
+{{ ansible_managed | comment }}
+global:
+  scrape_interval:     1m
+  evaluation_interval: 1m
+  # scrape_timeout is set to the global default (10s).
+
+  # Attach these labels to any time series or alerts when communicating with
+  # external systems (federation, remote storage, Alertmanager).
+  external_labels:
+      monitor: 'example'
+
+# Alertmanager configuration
+alerting:
+  alertmanagers:
+  - static_configs:
+    - targets: ['localhost:9093']
+
+# Load rules once and periodically evaluate them according to the global 'evaluation_interval'.
+rule_files:
+  # - "first_rules.yml"
+  # - "second_rules.yml"
+
+# A scrape configuration containing exactly one endpoint to scrape:
+# Here it's Prometheus itself.
+scrape_configs:
+  # The job name is added as a label `job=<job_name>` to any timeseries scraped from this config.
+  - job_name: 'prometheus'
+
+    # Override the global default and scrape targets from this job every 5 seconds.
+    # scrape_interval: 30s
+    # scrape_timeout: 30s
+
+    # metrics_path defaults to '/metrics'
+    # scheme defaults to 'http'.
+
+    static_configs:
+      - targets: ['localhost:9090']
+
+  - job_name: node
+    # If prometheus-node-exporter is installed, grab stats about the local
+    # machine by default.
+    static_configs:
+      - targets: ['localhost:9100']
+
+  - job_name: caddy
+    static_configs:
+      - targets: ['rproxy:2019', 'sites:2019']
diff --git a/ansible/roles/nextcloud/tasks/main.yaml b/ansible/roles/nextcloud/tasks/main.yaml
new file mode 100644
index 0000000..0d3697b
--- /dev/null
+++ b/ansible/roles/nextcloud/tasks/main.yaml
@@ -0,0 +1,5 @@
+---
+
+- name: 'Run the setup tasks'
+  ansible.builtin.import_tasks: 'setup.yaml'
+  tags: 'nextcloud'
diff --git a/ansible/roles/nextcloud/tasks/setup.yaml b/ansible/roles/nextcloud/tasks/setup.yaml
new file mode 100644
index 0000000..ac17702
--- /dev/null
+++ b/ansible/roles/nextcloud/tasks/setup.yaml
@@ -0,0 +1,40 @@
+---
+
+- name: 'setup | Ensure required vars are set'
+  ansible.builtin.assert:
+    that:
+      - item | mandatory
+  loop:
+    - '{{ nextcloud_nas_mount_path }}'
+    - '{{ nextcloud_php_max_mem_mb }}'
+    - '{{ nextcloud_php_max_upload_size_gb }}'
+  no_log: true
+
+- name: 'setup | Install required pkgs'
+  ansible.builtin.package:
+    name:
+      - 'nfs-common'
+
+- name: 'setup | Create the mount dir'
+  ansible.builtin.file:
+    path: '/mnt/data'
+    state: 'directory'
+    mode: '755'
+
+- name: 'setup | Setup the NFS mount'
+  ansible.posix.mount:
+    src: '{{ nextcloud_nas_mount_path }}'
+    path: '/mnt/data'
+    state: 'mounted'
+    fstype: 'nfs'
+
+- name: 'setup | Copy the docker-compose file'
+  ansible.builtin.template:
+    src: 'docker-compose.yaml.j2'
+    dest: 'docker-compose.yaml'
+    mode: '644'
+
+- name: 'setup | Start the service'
+  ansible.builtin.command: 'docker-compose up -d'
+  register: '_compose_up_cmd'
+  changed_when: '_compose_up_cmd.rc == 0'
diff --git a/ansible/roles/nextcloud/templates/docker-compose.yaml.j2 b/ansible/roles/nextcloud/templates/docker-compose.yaml.j2
new file mode 100644
index 0000000..3571432
--- /dev/null
+++ b/ansible/roles/nextcloud/templates/docker-compose.yaml.j2
@@ -0,0 +1,41 @@
+{{ ansible_managed | comment }}
+version: "3"
+services:
+  nextcloud:
+    image: nextcloud/all-in-one:latest
+    restart: always
+    container_name: nextcloud-aio-mastercontainer
+    volumes:
+      - nextcloud_aio_mastercontainer:/mnt/docker-aio-config
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    ports:
+      - 8080:8080
+    environment:
+    - APACHE_PORT=11000
+    - APACHE_IP_BINDING=0.0.0.0
+    - COLLABORA_SECCOMP_DISABLED=true
+    - NEXTCLOUD_DATADIR=/mnt/data
+    - NEXTCLOUD_MOUNT=/mnt/
+    - NEXTCLOUD_UPLOAD_LIMIT={{ nextcloud_php_max_upload_size_gb }}G
+    - NEXTCLOUD_MAX_TIME=3600
+    - NEXTCLOUD_MEMORY_LIMIT={{ nextcloud_php_max_mem_mb }}M
+    - NEXTCLOUD_STARTUP_APPS=deck twofactor_totp tasks calendar contacts notes memories richdocuments -photos
+    - NEXTCLOUD_ADDITIONAL_APKS=imagemagick
+    - NEXTCLOUD_ADDITIONAL_PHP_EXTENSIONS=imagick
+    - NEXTCLOUD_ENABLE_DRI_DEVICE={{ nextcloud_enable_dri }}
+    - TALK_PORT=3478
+    - WATCHTOWER_DOCKER_SOCKET_PATH=/var/run/docker.sock
+    - SKIP_DOMAIN_VALIDATION=true
+    networks:
+    - nextcloud-aio
+
+volumes:
+  nextcloud_aio_mastercontainer:
+    name: nextcloud_aio_mastercontainer
+
+networks:
+  nextcloud-aio:
+    name: nextcloud-aio
+    driver: bridge
+    driver_opts:                         
+      com.docker.network.driver.mtu: 1420
diff --git a/ansible/roles/plex/tasks/main.yaml b/ansible/roles/plex/tasks/main.yaml
new file mode 100644
index 0000000..5469534
--- /dev/null
+++ b/ansible/roles/plex/tasks/main.yaml
@@ -0,0 +1,5 @@
+---
+
+- name: 'Run the setup tasks'
+  ansible.builtin.import_tasks: 'setup.yaml'
+  tags: 'plex'
diff --git a/ansible/roles/plex/tasks/setup.yaml b/ansible/roles/plex/tasks/setup.yaml
new file mode 100644
index 0000000..de0eb69
--- /dev/null
+++ b/ansible/roles/plex/tasks/setup.yaml
@@ -0,0 +1,55 @@
+---
+
+- name: 'setup | Ensure required vars are set'
+  ansible.builtin.assert:
+    that:
+      - item | mandatory
+  loop:
+    - '{{ plex_nas_mount_path }}'
+  no_log: true
+
+- name: 'setup | Install required pkgs'
+  ansible.builtin.package:
+    name:
+      - 'nfs-common'
+      - 'curl'
+      - 'gnupg'
+
+- name: 'setup | Create the mount dir'
+  ansible.builtin.file:
+    path: '/mnt/data'
+    state: 'directory'
+    mode: '755'
+
+- name: 'setup | Setup the NFS mount'
+  ansible.posix.mount:
+    src: '{{ plex_nas_mount_path }}'
+    path: '/mnt/data'
+    state: 'mounted'
+    fstype: 'nfs'
+
+- name: 'setup | Get the Plex signed keys'
+  ansible.builtin.shell:
+    # noqa: risky-shell-pipe command-instead-of-module
+    cmd: >
+      curl -sS https://downloads.plex.tv/plex-keys/PlexSign.key | gpg --dearmor | tee /usr/share/keyrings/plex.gpg > /dev/null
+    creates: '/usr/share/keyrings/plex.gpg'
+
+- name: 'setup | Set the Plex sources'
+  ansible.builtin.copy:
+    dest: '/etc/apt/sources.list.d/plexmediaserver.list'
+    content: |
+      deb [signed-by=/usr/share/keyrings/plex.gpg] https://downloads.plex.tv/repo/deb public main
+    mode: '644'
+
+- name: 'setup | Install the package'
+  ansible.builtin.apt:
+    name: 'plexmediaserver'
+    state: 'present'
+    update_cache: true
+
+- name: 'setup | Start the service'
+  ansible.builtin.service:
+    name: 'plexmediaserver'
+    state: 'stopped'
+    enabled: true
diff --git a/ansible/roles/torrents/tasks/main.yaml b/ansible/roles/torrents/tasks/main.yaml
new file mode 100644
index 0000000..806a4e3
--- /dev/null
+++ b/ansible/roles/torrents/tasks/main.yaml
@@ -0,0 +1,5 @@
+---
+
+- name: 'Run the setup tasks'
+  ansible.builtin.import_tasks: 'setup.yaml'
+  tags: 'torrents'
diff --git a/ansible/roles/torrents/tasks/setup.yaml b/ansible/roles/torrents/tasks/setup.yaml
new file mode 100644
index 0000000..25f1fe8
--- /dev/null
+++ b/ansible/roles/torrents/tasks/setup.yaml
@@ -0,0 +1,79 @@
+---
+
+- name: 'setup | Ensure required vars are set'
+  ansible.builtin.assert:
+    that:
+      - item | mandatory
+  loop:
+    - '{{ torrents_nas_mount_path }}'
+    - '{{ torrents_rpc_username }}'
+    - '{{ torrents_rpc_password }}'
+  no_log: true
+
+- name: 'setup | Install required pkgs'
+  ansible.builtin.package:
+    name:
+      - 'nfs-common'
+      - 'transmission-daemon'
+
+- name: 'setup | Stop the transmission-daemon service'
+  ansible.builtin.service:
+    name: 'transmission-daemon'
+    state: 'stopped'
+
+- name: 'setup | Create the mount dir'
+  ansible.builtin.file:
+    path: '/mnt/data'
+    state: 'directory'
+    mode: '755'
+
+- name: 'setup | Setup the NFS mount'
+  ansible.posix.mount:
+    src: '{{ torrents_nas_mount_path }}'
+    path: '/mnt/data'
+    state: 'mounted'
+    fstype: 'nfs'
+
+- name: 'setup | Create new user for transmission'
+  ansible.builtin.user:
+    name: 'transmission-user'
+    uid: 1001
+    groups: 'users'
+    create_home: true
+
+- name: 'setup | Fix the service file to use our user'
+  ansible.builtin.lineinfile:
+    path: '/lib/systemd/system/transmission-daemon.service'
+    regexp: '^User='
+    line: 'User=transmission-user'
+
+- name: 'setup | Reload systemd daemon'
+  ansible.builtin.systemd:
+    daemon_reload: true
+
+# THis is kind of a hack to force the generation of
+# /home/transmission-user/.config/transmission-daemon dirs
+# so that we can place our config file there.
+- name: 'setup | Start the service'
+  ansible.builtin.service:
+    name: 'transmission-daemon'
+    state: 'started'
+
+# We still need to stop it to place the config file or else it will get overwritten
+- name: 'setup | Stop the service'
+  ansible.builtin.service:
+    name: 'transmission-daemon'
+    state: 'stopped'
+
+- name: 'setup | Copy the transmission config'
+  ansible.builtin.template:
+    src: 'settings.json.j2'
+    dest: '/home/transmission-user/.config/transmission-daemon/settings.json'
+    owner: 'transmission-user'
+    mode: '644'
+
+- name: 'setup | Start the service'
+  ansible.builtin.service:
+    name: 'transmission-daemon'
+    state: 'started'
+    enabled: true
diff --git a/ansible/roles/torrents/templates/settings.json.j2 b/ansible/roles/torrents/templates/settings.json.j2
new file mode 100644
index 0000000..cf5ea4b
--- /dev/null
+++ b/ansible/roles/torrents/templates/settings.json.j2
@@ -0,0 +1,73 @@
+{
+    "alt-speed-down": 50,
+    "alt-speed-enabled": false,
+    "alt-speed-time-begin": 540,
+    "alt-speed-time-day": 127,
+    "alt-speed-time-enabled": false,
+    "alt-speed-time-end": 1020,
+    "alt-speed-up": 50,
+    "bind-address-ipv4": "0.0.0.0",
+    "bind-address-ipv6": "::",
+    "blocklist-enabled": false,
+    "blocklist-url": "http://www.example.com/blocklist",
+    "cache-size-mb": 4,
+    "dht-enabled": true,
+    "download-dir": "/mnt/data/downloads",
+    "download-limit": 100,
+    "download-limit-enabled": 0,
+    "download-queue-enabled": true,
+    "download-queue-size": 5,
+    "encryption": 1,
+    "idle-seeding-limit": 30,
+    "idle-seeding-limit-enabled": false,
+    "incomplete-dir": "/home/transmission-user/downloads",
+    "incomplete-dir-enabled": false,
+    "lpd-enabled": false,
+    "max-peers-global": 200,
+    "message-level": 1,
+    "peer-congestion-algorithm": "",
+    "peer-id-ttl-hours": 6,
+    "peer-limit-global": 200,
+    "peer-limit-per-torrent": 50,
+    "peer-port": 51413,
+    "peer-port-random-high": 65535,
+    "peer-port-random-low": 49152,
+    "peer-port-random-on-start": false,
+    "peer-socket-tos": "default",
+    "pex-enabled": true,
+    "port-forwarding-enabled": false,
+    "preallocation": 1,
+    "prefetch-enabled": true,
+    "queue-stalled-enabled": true,
+    "queue-stalled-minutes": 30,
+    "ratio-limit": 2,
+    "ratio-limit-enabled": false,
+    "rename-partial-files": true,
+    "rpc-authentication-required": true,
+    "rpc-bind-address": "0.0.0.0",
+    "rpc-enabled": true,
+    "rpc-host-whitelist": "",
+    "rpc-host-whitelist-enabled": true,
+    "rpc-password": "{{ torrents_rpc_password }}",
+    "rpc-port": 9091,
+    "rpc-url": "/transmission/",
+    "rpc-username": "{{ torrents_rpc_username }}",
+    "rpc-whitelist": "*",
+    "rpc-whitelist-enabled": true,
+    "scrape-paused-torrents-enabled": true,
+    "script-torrent-done-enabled": false,
+    "script-torrent-done-filename": "",
+    "seed-queue-enabled": false,
+    "seed-queue-size": 10,
+    "speed-limit-down": 100,
+    "speed-limit-down-enabled": false,
+    "speed-limit-up": 100,
+    "speed-limit-up-enabled": false,
+    "start-added-torrents": true,
+    "trash-original-torrent-files": false,
+    "umask": 18,
+    "upload-limit": 100,
+    "upload-limit-enabled": 0,
+    "upload-slots-per-torrent": 14,
+    "utp-enabled": true
+}
diff --git a/ansible/roles/vault/tasks/main.yaml b/ansible/roles/vault/tasks/main.yaml
new file mode 100644
index 0000000..191bbc1
--- /dev/null
+++ b/ansible/roles/vault/tasks/main.yaml
@@ -0,0 +1,5 @@
+---
+
+- name: 'Run the setup tasks'
+  ansible.builtin.import_tasks: 'setup.yaml'
+  tags: 'vault'
diff --git a/ansible/roles/vault/tasks/setup.yaml b/ansible/roles/vault/tasks/setup.yaml
new file mode 100644
index 0000000..f05aeee
--- /dev/null
+++ b/ansible/roles/vault/tasks/setup.yaml
@@ -0,0 +1,12 @@
+---
+
+- name: 'setup | Copy the docker-compose file'
+  ansible.builtin.template:
+    src: 'docker-compose.yaml.j2'
+    dest: 'docker-compose.yaml'
+    mode: '644'
+
+- name: 'setup | Start the service'
+  ansible.builtin.command: 'docker-compose up -d'
+  register: '_compose_up_cmd'
+  changed_when: '_compose_up_cmd.rc == 0'
diff --git a/ansible/roles/vault/templates/docker-compose.yaml.j2 b/ansible/roles/vault/templates/docker-compose.yaml.j2
new file mode 100644
index 0000000..7c9d74c
--- /dev/null
+++ b/ansible/roles/vault/templates/docker-compose.yaml.j2
@@ -0,0 +1,28 @@
+{{ ansible_managed | comment }}
+version: "3"
+services:
+  vaultwarden:
+    image: vaultwarden/server:latest
+    restart: always
+    container_name: vaultwarden
+    volumes:
+      - vaultwarden:/data
+    ports:
+      - 8989:80
+    environment:
+      - WEBSOCKET_ENABLED=true
+      - INVITATIONS_ALLOWED=true
+      - SIGNUPS_ALLOWED=true
+    networks:
+    - vaultwarden
+
+volumes:
+  vaultwarden:
+    name: vaultwarden
+
+networks:
+  vaultwarden:
+    name: vaultwarden
+    driver: bridge
+    driver_opts:                         
+      com.docker.network.driver.mtu: 1420