ConfigLMM 0.2.0 → 0.3.0

data/Plugins/Apps/PostgreSQL/PostgreSQL.lmm.rb

@@ -14,50 +14,199 @@ module ConfigLMM
             def actionPostgreSQLDeploy(id, target, activeState, context, options)
                 self.ensurePackage(PACKAGE_NAME, target['Location'])
                 self.ensureServiceAutoStart(SERVICE_NAME, target['Location'])
+                self.startService(SERVICE_NAME, target['Location'])
 
                 if target['Location'] && target['Location'] != '@me'
                     uri = Addressable::URI.parse(target['Location'])
                     raise Framework::PluginProcessError.new("#{id}: Unknown Protocol: #{uri.scheme}!") if uri.scheme != 'ssh'
-                    if target['ListenAll']
-                        cmd = "sed -i 's|^host    all             all             127.0.0.1/32            ident|host    all             all             0.0.0.0/0               scram-sha-256|'"
-                        dir = updateConfigOverSSH(uri, cmd)
-                        updateRemoteFile(uri, dir + CONFIG_FILE, options, false) do |configLines|
-                            configLines << "listen_addresses = '*'\n"
+
+                    self.class.sshStart(uri) do |ssh|
+                        self.updateSettingsOverSSH(target, ssh, options)
+                        self.class.sshExec!(ssh, "su --login #{USER_NAME} --command 'pg_ctl reload'")
+                        self.class.createUsersOverSSH(target, ssh)
+                        self.class.createDatabasesOverSSH(target, ssh)
+                        self.class.createPublicationsOverSSH(target, ssh)
+                        self.class.createSubscriptionsOverSSH(target, ssh)
+                    end
+                else
+                    `pg_ctl reload`
+                end
+
+            end
+
+            def updateListenLocal(target)
+                dir = pgsqlDir(self.class.distroID)
+                if target['ListenAll']
+                    `sed -i 's|^host    all             all             127.0.0.1/32            ident|host    all             all             0.0.0.0/0            scram-sha-256|' #{dir + HBA_FILE}`
+                    updateLocalFile(dir + CONFIG_FILE, options) do |configLines|
+                        configLines << "listen_addresses = '*'\n"
+                    end
+                else
+                    `sed -i 's|^host    all             all             127.0.0.1/32            ident|host    all             all             127.0.0.1/32            scram-sha-256|' #{dir + HBA_FILE}`
+                end
+            end
+
+            def updateSettingsOverSSH(target, ssh, options)
+                dir = nil
+                settingLines = []
+                hbaLines = []
+                if target['ListenAll']
+                    cmd = "sed -i 's|^host    all             all             127.0.0.1/32            ident|host    all             all             0.0.0.0/0               scram-sha-256|'"
+                    dir = updateConfigOverSSH(ssh, cmd)
+                    settingLines << "listen_addresses = '*'\n"
+                    Framework::LinuxApp.firewallAddPortOverSSH('5432/tcp', ssh)
+                elsif target['Listen'] && !target['Listen'].empty?
+                    cmd = "sed -i 's|^host    all             all             127.0.0.1/32            ident|host    all             all             127.0.0.1/32            scram-sha-256|'"
+                    dir = updateConfigOverSSH(ssh, cmd)
+
+                    ips = target['Listen'].map { |addr| addr.split('/').first }.join(',')
+                    settingLines << "listen_addresses = '#{ips}'\n"
+
+                    target['Listen'].each do |addr|
+                        if addr != 'localhost' && !addr.start_with?('127.0.0.1') && !addr.start_with?('::1')
+                            hbaLines << "host    all             all             #{addr}            scram-sha-256\n"
                         end
-                    else
-                        cmd = "sed -i 's|^host    all             all             127.0.0.1/32            ident|host    all             all             127.0.0.1/32            scram-sha-256|'"
-                        updateConfigOverSSH(uri, cmd)
                     end
                 else
-                    dir = pgsqlDir(self.class.distroID)
-                    if target['ListenAll']
-                        `sed -i 's|^host    all             all             127.0.0.1/32            ident|host    all             all             0.0.0.0/0            scram-sha-256|' #{dir + HBA_FILE}`
-                        updateLocalFile(dir + CONFIG_FILE, options) do |configLines|
-                            configLines << "listen_addresses = '*'"
+                    cmd = "sed -i 's|^host    all             all             127.0.0.1/32            ident|host    all             all             127.0.0.1/32            scram-sha-256|'"
+                    dir = updateConfigOverSSH(ssh, cmd)
+                end
+                #if !target['Publications'].to_h.empty?
+                #    target['Settings'] ||= {}
+                #    target['Settings']['wal_level'] = 'logical'
+                #end
+                target['Settings'].to_h.each do |name, value|
+                    settingLines << "#{name} = #{value}\n"
+                end
+                if !hbaLines.empty?
+                    updateRemoteFile(ssh, dir + HBA_FILE, options, false) do |configLines|
+                        configLines += hbaLines
+                    end
+                end
+                if !settingLines.empty?
+                    updateRemoteFile(ssh, dir + CONFIG_FILE, options, false) do |configLines|
+                        configLines += settingLines
+                    end
+                end
+            end
+
+            def self.createUsersOverSSH(target, ssh)
+                target['Users'].to_a.each do |user, info|
+                    self.sshExec!(ssh, "su --login #{USER_NAME} --command 'createuser #{user}'", true)
+                    if !info['Password'].to_s.empty?
+                        password = self.loadVariable(info['Password'], target).to_s
+                        if !password.empty?
+                            sql = "ALTER USER #{user} WITH PASSWORD '#{password}'"
+                            self.executeSQL(sql, nil, ssh)
                         end
+                    end
+                    if info['Replication'] && info['Replication'] != 'no'
+                        self.executeSQL("ALTER USER #{user} REPLICATION", nil, ssh)
+                        self.executeSQL("GRANT pg_read_all_data TO #{user}", nil, ssh)
+                    end
+                end
+            end
+
+            def self.createDatabasesOverSSH(target, ssh)
+                target['Databases'].to_a.each do |db, info|
+                    self.sshExec!(ssh, "su --login #{USER_NAME} --command 'createdb #{db}'", true)
+                end
+            end
+
+            def self.createPublicationsOverSSH(target, ssh)
+                return if target['Publications'].to_h.empty?
+
+                target['Publications'].each do |name, data|
+                    data['Database'] = name unless data['Database']
+                    if data['Tables'].is_a?(Array)
+                        # TODO
+                    elsif data['Tables'] == 'All'
+                        sql = "CREATE PUBLICATION #{name} FOR ALL TABLES"
+                        self.executeSQL(sql, data['Database'], ssh, true)
                     else
-                        `sed -i 's|^host    all             all             127.0.0.1/32            ident|host    all             all             127.0.0.1/32            scram-sha-256|' #{dir + HBA_FILE}`
+                        raise "Invalid Tables field: #{data['Tables']}"
                     end
                 end
+            end
 
-                self.startService(SERVICE_NAME, target['Location'])
+            def self.createSubscriptionsOverSSH(target, ssh)
+                return if target['Subscriptions'].to_h.empty?
+
+                target['Subscriptions'].each do |name, data|
+                    data['Database'] = name unless data['Database']
+                    data['Publication'] = name unless data['Publication']
+                    connection = self.loadVariable(data['Connection'], target).to_s
+
+                    authParams = '--host=' + connection.match('host=([^ ]+)')[1]
+                    authParams += ' --username=' + connection.match('user=([^ ]+)')[1]
+                    password = connection.match('password=([^ ]+)')[1]
+
+                    self.importRemoteSchemaOverSSH(name, data['Database'], password, authParams, ssh)
+
+                    sql = "CREATE SUBSCRIPTION #{name} CONNECTION '#{connection}' PUBLICATION #{data['Publication']}"
+                    self.executeSQL(sql, data['Database'], ssh, true)
+                end
+            end
+
+            def self.importRemoteSchemaOverSSH(sourceDB, targetDB, password, authParams, ssh)
+                self.sshExec!(ssh, "su --login #{USER_NAME} --command 'createdb #{targetDB}'", true)
+                cmd = " su --login #{USER_NAME} --command 'PGPASSWORD=#{password} pg_dump --schema-only --no-owner --dbname=#{sourceDB} #{authParams} | psql --dbname=#{targetDB}'"
+                self.sshExec!(ssh, cmd)
             end
 
-            def updateConfigOverSSH(uri, cmd)
+            def updateConfigOverSSH(ssh, cmd)
                 dir = ''
-                self.class.sshStart(uri) do |ssh|
-                    distroID = self.class.distroIDfromSSH(ssh)
-                    dir = pgsqlDir(distroID)
-                    self.class.sshExec!(ssh, cmd + ' ' + dir + HBA_FILE)
-                end
+                distroID = self.class.distroID(ssh)
+                dir = pgsqlDir(distroID)
+                self.class.sshExec!(ssh, cmd + ' ' + dir + HBA_FILE)
                 dir
             end
 
+            def self.createRemoteUserAndDBOverSSH(settings, user, password, ssh)
+                    self.executeRemotelyOverSSH(settings, ssh) do |ssh|
+                        self.createUserAndDBOverSSH(user, password, ssh)
+                    end
+            end
+
+            def self.executeRemotelyOverSSH(settings, ssh)
+                settings['HostName'] = 'localhost' unless settings['HostName']
+                if settings['HostName'] == 'localhost'
+                    yield(ssh)
+                else
+                    self.sshStart("ssh://#{settings['HostName']}/") do |ssh|
+                        yield(ssh)
+                    end
+                end
+            end
+
             def self.createUserAndDBOverSSH(user, password, ssh)
                 self.sshExec!(ssh, "su --login #{USER_NAME} --command 'createuser #{user}'", true)
                 self.sshExec!(ssh, "su --login #{USER_NAME} --command 'createdb --owner=#{user} #{user}'", true)
-                cmd = " su --login #{USER_NAME} --command ' psql -c \"ALTER USER #{user} WITH PASSWORD \\'#{password}\\';\"'"
-                self.sshExec!(ssh, cmd)
+                if password
+                    sql = "ALTER USER #{user} WITH PASSWORD '#{password}'"
+                    self.executeSQL(sql, nil, ssh)
+                end
+            end
+
+            def self.importSQL(owner, db, sqlFile, ssh = nil)
+                if ssh
+                    self.sshExec!(ssh, "echo \"SET ROLE '#{owner}';\" > /tmp/postgres_import.sql")
+                    self.sshExec!(ssh, "cat #{sqlFile} >> /tmp/postgres_import.sql")
+                    cmd = "su --login #{USER_NAME} --command 'psql #{db} < /tmp/postgres_import.sql'"
+                    self.sshExec!(ssh, cmd)
+                else
+                    # TODO
+                end
+            end
+
+            def self.executeSQL(sql, db, ssh = nil, allowFailure = false)
+                if ssh
+                    db = 'postgres' unless db
+                    cmd = " su --login #{USER_NAME} --command ' psql --dbname=#{db} --command=\"#{sql.gsub("'", "\\\\'")};\"'"
+                    self.sshExec!(ssh, cmd, allowFailure)
+                else
+                    # TODO
+                end
             end
 
             def pgsqlDir(distroID)

data/Plugins/Apps/SSH/SSH.lmm.rb

@@ -0,0 +1,51 @@
+
+module ConfigLMM
+    module LMM
+        class SSH < Framework::LinuxApp
+
+            CONFIG_FILE = '/etc/ssh/sshd_config'
+
+            def actionSSHDeploy(id, target, activeState, context, options)
+
+                if target['Location'] && target['Location'] != '@me'
+                    uri = Addressable::URI.parse(target['Location'])
+                    raise Framework::PluginProcessError.new("#{id}: Unknown Protocol: #{uri.scheme}!") if uri.scheme != 'ssh'
+
+                    self.class.sshStart(uri) do |ssh|
+                        if target['Port']
+                            self.class.sshExec!(ssh, "sed -i 's|^Port |#Port |' #{CONFIG_FILE}")
+                        end
+                        if target['ListenAddress']
+                            self.class.sshExec!(ssh, "sed -i 's|^ListenAddress |#ListenAddress |' #{CONFIG_FILE}")
+                        end
+                        target['Settings'].to_h.each do |name, value|
+                            self.class.sshExec!(ssh, "sed -i 's|^#{name} |##{name} |' #{CONFIG_FILE}")
+                        end
+                        updateRemoteFile(ssh, CONFIG_FILE, options) do |configLines|
+                            if target['Port']
+                                configLines << "Port #{target['Port']}\n"
+                            end
+                            if target['ListenAddress']
+                                configLines << "ListenAddress #{target['ListenAddress']}\n"
+                            end
+                            target['Settings'].to_h.each do |name, value|
+                                value = 'yes' if value.is_a?(TrueClass)
+                                value = 'no' if value.is_a?(FalseClass)
+                                configLines << "#{name} #{value}\n"
+                            end
+                            configLines
+                        end
+                        if target['Port']
+                          Framework::LinuxApp.firewallAddPortOverSSH(target['Port'].to_s + '/tcp', uri)
+                        end
+                    end
+                else
+                    # TODO
+                end
+
+            end
+
+        end
+
+    end
+end

data/Plugins/Apps/UVdesk/UVdesk.conf.erb

@@ -0,0 +1,52 @@
+
+upstream uvdesk
+{
+<% if config['Server'] %>
+    server <%= config['Server'] %>;
+<% else %>
+    server unix:/run/php-fpm/uvdesk.sock;
+<% end %>
+}
+
+server
+{
+    <% if !config['TLS'] %>
+        listen       <%= config['Port'] %>;
+        listen  [::]:<%= config['Port'] %>;
+    <% else %>
+        <% if config['NginxVersion'] >= 1.25 %>
+            listen <%= config['Port'] %> ssl;
+            listen [::]:<%= config['Port'] %> ssl;
+            http2 on;
+            http3 on;
+            quic_retry on;
+            add_header Alt-Svc 'h3=":<%= config['Port'] %>"; ma=86400';
+        <% else %>
+            listen <%= config['Port'] %> ssl http2;
+            listen [::]:<%= config['Port'] %> ssl http2;
+        <% end %>
+
+        include config-lmm/ssl.conf;
+    <% end %>
+
+    server_name <%= config['Domain'] %>;
+
+    access_log  /var/log/nginx/uvdesk.access.log;
+    error_log   /var/log/nginx/uvdesk.error.log;
+
+    root /srv/uvdesk/public;
+    index index.php;
+
+    include config-lmm/errors.conf;
+
+    location ~ \.php(?:$|/)
+    {
+        fastcgi_pass uvdesk;
+        include fastcgi.conf;
+    }
+
+    location / {
+        try_files $uri $uri/ /index.php$request_uri;
+    }
+
+}

data/Plugins/Apps/UVdesk/UVdesk.lmm.rb

@@ -0,0 +1,85 @@
+
+module ConfigLMM
+    module LMM
+        class UVdesk < Framework::NginxApp
+
+            USER = 'uvdesk'
+            HOME_DIR = '/srv/uvdesk'
+            DOWNLOAD_URL = 'https://cdn.uvdesk.com/uvdesk/downloads/opensource/uvdesk-community-current-stable.zip'
+
+            def actionUVdeskDeploy(id, target, activeState, context, options)
+                raise Framework::PluginProcessError.new('Domain field must be set!') unless target['Domain']
+
+                target['Database'] ||= {}
+                if target['Location'] && target['Location'] != '@me'
+                    uri = Addressable::URI.parse(target['Location'])
+                    raise Framework::PluginProcessError.new("#{id}: Unknown Protocol: #{uri.scheme}!") if uri.scheme != 'ssh'
+
+                    self.class.sshStart(uri) do |ssh|
+                        dbPassword = self.configureMariaDB(target['Database'], ssh)
+
+                        Framework::LinuxApp.ensurePackages([PHP_FPM::PHPFPM_PACKAGE, 'php-pecl', 'make'], ssh)
+                        Framework::LinuxApp.ensureServiceAutoStartOverSSH(PHP_FPM::PHPFPM_SERVICE, ssh)
+                        distroInfo = Framework::LinuxApp.currentDistroInfo(ssh)
+                        addUserCmd = "#{distroInfo['CreateServiceUser']} --home-dir '#{HOME_DIR}' --create-home --comment 'UVdesk' #{USER}"
+                        self.class.sshExec!(ssh, addUserCmd, true)
+                        if !self.class.remoteFilePresent?(HOME_DIR + '/public/index.php', ssh)
+                            self.class.sshExec!(ssh, "curl #{DOWNLOAD_URL} > /tmp/uvdesk.zip")
+                            self.class.sshExec!(ssh, "su --login #{USER} --shell /bin/sh --command 'cd ~ && unzip /tmp/uvdesk.zip'")
+                            self.class.sshExec!(ssh, "su --login #{USER} --shell /bin/sh --command 'mv ~/uvdesk-*/* ~/'")
+                            self.class.sshExec!(ssh, "su --login #{USER} --shell /bin/sh --command 'mv ~/uvdesk-*/.[!.]* ~/'")
+                            self.class.sshExec!(ssh, "su --login #{USER} --shell /bin/sh --command 'rm -r ~/uvdesk-*'")
+                            self.class.sshExec!(ssh, 'rm -f /tmp/uvdesk.zip')
+                        end
+
+                        self.class.sshExec!(ssh, "mkdir -p /var/log/php/")
+                        self.class.sshExec!(ssh, "touch /var/log/php/uvdesk.errors.log")
+                        self.class.sshExec!(ssh, "touch /var/log/php/uvdesk.mail.log")
+                        self.class.sshExec!(ssh, "chown #{USER}:#{USER} /var/log/php/uvdesk.errors.log")
+                        self.class.sshExec!(ssh, "chown #{USER}:#{USER} /var/log/php/uvdesk.mail.log")
+                        PHP_FPM::fixConfigFileOverSSH(distroInfo, ssh)
+
+                        target['User'] = USER unless target['User']
+                        target['PHP-FPM'] ||= {}
+                        target['PHP-FPM']['chdir'] = HOME_DIR unless target['PHP-FPM']['chdir']
+                        name = 'uvdesk'
+                        self.updateRemoteFile(ssh, PHP_FPM.configDir(distroInfo) + name + '.conf', options, false, ';') do |configLines|
+                            PHP_FPM.writeConfig(name, target, distroInfo, configLines)
+                        end
+
+
+                        PHP_FPM.enableExtensionOverSSH('mysqli', distroInfo, ssh)
+                        PHP_FPM.enableExtensionOverSSH('mbstring', distroInfo, ssh) # Needed by mailparse
+
+                        imapPackage = 'imap'
+                        imapPackage = 'imap-1.0.0' if distroInfo['Name'] == 'openSUSE Leap'
+                        PHP_FPM.peclInstallOverSSH(imapPackage, ssh)
+                        PHP_FPM.enableExtensionOverSSH('imap', distroInfo, ssh)
+
+                        PHP_FPM.peclInstallOverSSH('mailparse', ssh)
+                        PHP_FPM.enableExtensionOverSSH('mailparse', distroInfo, ssh)
+
+                        Framework::LinuxApp.startServiceOverSSH(PHP_FPM::PHPFPM_SERVICE, ssh)
+
+                        Framework::LinuxApp.ensurePackages([NGINX_PACKAGE], ssh)
+                        Framework::LinuxApp.ensureServiceAutoStartOverSSH(NGINX_PACKAGE, ssh)
+                        self.class.prepareNginxConfig(target, ssh)
+                        self.writeNginxConfig(__dir__, 'UVdesk', id, target, state, context, options)
+                        self.deployNginxConfig(id, target, activeState, context, options)
+                        Framework::LinuxApp.startServiceOverSSH(NGINX_PACKAGE, ssh)
+                    end
+                else
+                    # TODO
+                end
+            end
+
+            def configureMariaDB(settings, ssh)
+                password = SecureRandom.alphanumeric(20)
+                # TODO
+                password
+            end
+
+        end
+    end
+end
+

data/Plugins/Apps/Valkey/Valkey.lmm.rb

@@ -13,7 +13,7 @@ module ConfigLMM
 
                 if target['Location'] && target['Location'] != '@me'
                     self.class.sshStart(target['Location']) do |ssh|
-                        distroId = self.class.distroIDfromSSH(ssh)
+                        distroId = self.class.distroID(ssh)
                         if distroId == SUSE_ID
                             serviceName = 'redis@redis'
                             self.class.sshExec!(ssh, "touch #{CONFIG_FILE}")
@@ -25,6 +25,7 @@ module ConfigLMM
                         end
 
                         if target['Settings']
+                            target['Settings']['bind'] = '127.0.0.1' unless target['Settings']['bind']
                             updateRemoteFile(ssh, CONFIG_FILE, options, false) do |configLines|
                                 target['Settings'].each do |name, value|
                                     configLines << "#{name} #{value}\n"

data/Plugins/Apps/Vaultwarden/Vaultwarden.conf.erb

@@ -1,22 +1,39 @@
 
 upstream vaultwarden {
-    server 127.0.0.1:8000;
-}
-
-upstream vaultwarden-websocket {
-    server 127.0.0.1:3012;
+    <% if config['Server'] %>
+        server <%= config['Server'] %>;
+    <% else %>
+        server 127.0.0.1:18000;
+    <% end %>
+    keepalive 2;
 }
 
 server {
 
-    <% if !config['TLS'] %>
-        listen       <%= config['Port'] %>;
-        listen  [::]:<%= config['Port'] %>;
-    <% else %>
-        listen       <%= config['Port'] %> ssl;
-        listen  [::]:<%= config['Port'] %> ssl;
+    <% if config['NginxVersion'] >= 1.25 %>
+        <% if !config['TLS'] %>
+            listen       <%= config['Port'] %>;
+            listen  [::]:<%= config['Port'] %>;
+        <% else %>
+            listen       <%= config['Port'] %> ssl;
+            listen  [::]:<%= config['Port'] %> ssl;
+
+            include config-lmm/ssl.conf;
+        <% end %>
         http2 on;
-        include config-lmm/ssl.conf;
+        http3 on;
+        quic_retry on;
+        add_header Alt-Svc 'h3=":443"; ma=86400';
+    <% else %>
+        <% if !config['TLS'] %>
+            listen       <%= config['Port'] %>;
+            listen  [::]:<%= config['Port'] %>;
+        <% else %>
+            listen       <%= config['Port'] %> ssl http2;
+            listen  [::]:<%= config['Port'] %> ssl http2;
+
+            include config-lmm/ssl.conf;
+        <% end %>
     <% end %>
 
     server_name <%= config['Domain'] %>;
@@ -37,12 +54,12 @@ server {
         include config-lmm/proxy.conf;
     }
 
-    location /notifications/ {
-        proxy_pass http://vaultwarden-websocket/;
+    #location /notifications/ {
+    #    proxy_pass http://127.0.0.1:3012/;
 
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";
-        include config-lmm/proxy.conf;
-    }
+    #    proxy_set_header Upgrade $http_upgrade;
+    #    proxy_set_header Connection "upgrade";
+    #    include config-lmm/proxy.conf;
+    #}
 
 }

data/Plugins/Apps/Vaultwarden/Vaultwarden.container

@@ -0,0 +1,16 @@
+[Unit]
+Description=vaultwarden container
+After=local-fs.target
+
+[Container]
+AutoUpdate=registry
+Image=ghcr.io/dani-garcia/vaultwarden:latest
+Exec=/start.sh
+EnvironmentFile=/var/lib/vaultwarden/.config/containers/systemd/Vaultwarden.env
+Network=slirp4netns:allow_host_loopback=true
+PublishPort=0.0.0.0:18000:8000
+UserNS=keep-id:uid=1000,gid=1000
+Volume=/var/lib/vaultwarden/data/:/data/
+
+[Install]
+WantedBy=multi-user.target default.target

data/Plugins/Apps/Vaultwarden/Vaultwarden.lmm.rb

@@ -5,8 +5,12 @@ module ConfigLMM
     module LMM
         class Vaultwarden < Framework::NginxApp
 
+            NAME = 'Vaultwarden'
+            USER = 'vaultwarden'
+            HOME_DIR = '/var/lib/vaultwarden'
+
             def actionVaultwardenBuild(id, target, state, context, options)
-                writeNginxConfig(__dir__, 'Vaultwarden', id, target, state, context, options)
+                writeNginxConfig(__dir__, NAME, id, target, state, context, options)
             end
 
             def actionVaultwardenDiff(id, target, activeState, context, options)
@@ -14,8 +18,43 @@ module ConfigLMM
             end
 
             def actionVaultwardenDeploy(id, target, activeState, context, options)
-                if !target['Location'] || target['Location'] == '@me'
-                    deployNginxConfig(id, target, activeState, context, options)
+                if target['Location'] && target['Location'] != '@me'
+                    uri = Addressable::URI.parse(target['Location'])
+                    self.class.sshStart(uri) do |ssh|
+                        if !target.key?('Proxy') || target['Proxy'] != 'only'
+                            distroInfo = Framework::LinuxApp.currentDistroInfo(ssh)
+                            Framework::LinuxApp.configurePodmanServiceOverSSH(USER, HOME_DIR, 'Vaultwarden', distroInfo, ssh)
+                            self.class.sshExec!(ssh, "su --login #{USER} --shell /bin/sh --command 'mkdir -p ~/data'")
+                            path = Framework::LinuxApp::SYSTEMD_CONTAINERS_PATH.gsub('~', HOME_DIR)
+                            self.class.sshExec!(ssh, "echo 'ROCKET_PORT=8000' > #{path}/Vaultwarden.env")
+                            if target['Domain']
+                                self.class.sshExec!(ssh, "echo 'DOMAIN=https://#{target['Domain']}' >> #{path}/Vaultwarden.env")
+                            end
+                            target['Signups'] = false unless target['Signups']
+                            self.class.sshExec!(ssh, "echo 'SIGNUPS_ALLOWED=#{target['Signups'].to_s}' >> #{path}/Vaultwarden.env")
+                            if target.key?('Invitations')
+                                self.class.sshExec!(ssh, "echo 'INVITATIONS_ALLOWED=#{target['Invitations'].to_s}' >> #{path}/Vaultwarden.env")
+                            end
+                            if ENV.key?('VAULTWARDEN_ADMIN_TOKEN')
+                                token = ENV['VAULTWARDEN_ADMIN_TOKEN']
+                                token = SecureRandom.alphanumeric(40) if token.empty?
+                                self.class.sshExec!(ssh, "echo 'ADMIN_TOKEN=#{token}' >> #{path}/Vaultwarden.env")
+                            end
+                            self.class.sshExec!(ssh, "chown #{USER}:#{USER} #{path}/Vaultwarden.env")
+                            self.class.sshExec!(ssh, "chmod 600 #{path}/Vaultwarden.env")
+
+                            ssh.scp.upload!(__dir__ + '/Vaultwarden.container', path)
+                            self.class.sshExec!(ssh, "systemctl --user --machine=#{USER}@ daemon-reload")
+                            self.class.sshExec!(ssh, "systemctl --user --machine=#{USER}@ start Vaultwarden")
+                        end
+                        if !target.key?('Proxy') || !!target['Proxy']
+                            self.class.prepareNginxConfig(target, ssh)
+                            writeNginxConfig(__dir__, NAME, id, target, state, context, options)
+                            deployNginxConfig(id, target, activeState, context, options)
+                        end
+                    end
+                else
+                    # TODO
                     activeState['Location'] = '@me'
                 end
             end