Vaultwarden Backup
This role backs up Vaultwarden (self-hosted Bitwarden) password vault using the official Bitwarden CLI.
Overview
This role backs up Vaultwarden (self-hosted Bitwarden) password vault using the official Bitwarden CLI. It downloads the CLI temporarily, authenticates with API credentials, exports the vault as encrypted JSON, and stores it on dual NAS storage. The role automatically manages retention by keeping only the last 5 backups per NAS.
What This Role Does
- Ensures backup directories exist on both NAS mount points
- Creates temporary directory for Bitwarden CLI
- Downloads Bitwarden CLI from official source
- Ensures unzip is installed (for extracting CLI)
- Extracts Bitwarden CLI binary
- Sets executable permissions on CLI binary
- Configures server URL for Vaultwarden instance
- Logs in with API credentials (using environment variables, retrieved from Ansible Vault)
- Unlocks vault with master password
- Extracts session key for operations that need authentication
- Syncs vault to ensure latest data
- Exports vault as encrypted JSON to Synology NAS
- Exports vault as encrypted JSON to Proxmox OMV NAS
- Locks vault (clears session)
- Logs out from Vaultwarden
- Displays success message
- Cleans up temporary CLI directory
- Removes old backups, keeping only the 5 most recent per NAS
Role Variables
| Variable | Description |
|---|---|
vault_vaultwarden_api_client_id | Vaultwarden API client ID (from vault) |
vault_vaultwarden_api_client_secret | Vaultwarden API client secret (from vault) |
vault_vaultwarden_master_password | Vault master password (from vault) |
vault_vaultwarden_backup_export_password | Password to encrypt the export file (from vault) |
vaultwarden_backup_url | Vaultwarden instance URL |
vaultwarden_backup_ca_file | Custom CA certificate path (empty = system CA) |
vaultwarden_backup_syno_mount_point | Synology NAS backup destination |
vaultwarden_backup_prxmxomv_mount_point | Proxmox OMV NAS backup destination |
Notes
- The Bitwarden CLI is downloaded to a temp directory and deleted after the backup
- The export is encrypted with a dedicated password, separate from the master password (stored in Ansible Vault)
- All sensitive values use
no_log: true; credentials are not displayed in console output - Keeps last 5 backups per NAS; older files are automatically deleted
- API client ID/secret are obtained from Vaultwarden: Settings → Security → Keys → View API Key