Applications

Applications

Run applications only after a successful Setup and SSH Migration and a healthy Docker and Traefik deployment.

Every application host must be a member of traefik_hosts and its application group. The roles fail early if either membership is missing.

Deploy all configured application groups:

uv run ansible-playbook \
  -i inventories/production/hosts.yaml \
  --ask-vault-pass \
  playbooks/apps.yaml

Deploy one host only:

uv run ansible-playbook \
  -i inventories/production/hosts.yaml \
  --ask-vault-pass \
  playbooks/apps.yaml \
  --limit server-01

Vaultwarden

Add the host to vaultwarden_hosts. Configure:

# group_vars/vaultwarden_hosts.yaml
vaultwarden_domain: vault.example.com
vaultwarden_admin_token: "{{ vault_vaultwarden_admin_token }}"

The role stores persistent data in /opt/vaultwarden/data, routes HTTPS through Traefik, and disables public signups by default. The container does not publish a host port.

Verify:

sudo docker compose -f /opt/vaultwarden/compose.yaml ps
curl -I https://vault.example.com

3x-ui

Add the host to three_x_ui_hosts. Configure the panel and at least one unique inbound:

# group_vars/three_x_ui_hosts.yaml
three_x_ui_panel_domain: panel.example.com
three_x_ui_inbounds:
  - hostname: vless.example.com
    port: 10001
  - hostname: trojan.example.com
    port: 10002

The panel is proxied through Traefik HTTPS to internal port 2053. Each inbound uses TLS passthrough on Traefik's websecure entrypoint. The Xray inbound, not Traefik, must hold a valid certificate for each inbound hostname.

Persistent data: /opt/3x-ui/data.

Telemt

Add the host to telemt_hosts. Configure public non-secret values:

# group_vars/telemt_hosts.yaml
telemt_sni_hostname: example.com
telemt_config: "{{ vault_telemt_config }}"

The encrypted vault_telemt_config is written to /opt/telemt/config/telemt.toml with mode 0600. The default internal listen port is 1234.

These values must agree:

• telemt_listen_port equals [server] port in the TOML.
• telemt_sni_hostname equals [censorship] tls_domain in the TOML.

Telemt receives TLS passthrough through Traefik by SNI. Its container port is not host-published.

Verify:

sudo docker compose -f /opt/telemt/compose.yaml ps
sudo docker logs telegram-proxy --tail 100