1 files changed, 76 insertions, 0 deletions
diff --git a/services/vaultwarden.nix b/services/vaultwarden.nix
new file mode 100644
index 0000000..f68a2fa
--- /dev/null
+++ b/services/vaultwarden.nix
@@ -0,0 +1,76 @@
+{config, pkgs, lib, ...}: 
+let
+  cfg = config.wilkuu.services.vaultwarden; 
+  hostname = config.networking.hostName; 
+in 
+{
+  options.wilkuu.services.vaultwarden = with lib; {
+    domain = mkOption {
+      type = types.str; 
+      default = "bitwarden.${hostname}.local"; 
+      example = "bitwarden.wilkuu.xyz"; 
+      description = "Domain for http connections.";  
+    };  
+    doACME = mkEnableOption "Enable ACME for vaultwarden here";
+    enable = mkEnableOption "Enable the vaultwarden service"; 
+    backupDir = mkOption { 
+     type = types.path; 
+     description = "Storage localtion for Vaultwarden user data backup";
+     default = "/srv/data/vaultwarden";
+     example = "/srv/data/vaultwarden";
+    }; 
+    signupWhitelist = mkOption {
+      type = types.listOf types.str; 
+      default = []; 
+      example = ["wilkuu.xyz"]; 
+      description = "Domains that can sign up on vaultwarden";
+    }; 
+  };
+
+  config = lib.mkIf cfg.enable (let 
+    sopsPath = ../secrets/${hostname}/vaultwarden.yaml;
+    secrets = ["admin_token"]; 
+    toSops  = (sname: "vaultwarden/${sname}");
+    toCredfilePath = (name: config.sops.secrets.${toSops name}.path); 
+  in {
+     networking.hosts = {
+      "127.0.0.1" = [cfg.domain];
+     };
+
+    sops.secrets = 
+      (lib.genAttrs (map toSops secrets) 
+        (name: {
+          sopsFile = sopsPath; 
+          mode = "0440"; 
+          owner = "vaultwarden";  
+        }));   
+
+    sops.templates.vaultwardenEnvFile.content = ''
+      ADMIN_TOKEN=${config.sops.placeholder."vaultwarden/admin_token"}
+    '';
+    
+    services.nginx.virtualHosts."${cfg.domain}" = {
+      enableACME = cfg.doACME;
+      addSSL = cfg.doACME; 
+      locations."/" = {
+        proxyPass = "http://localhost:3222"; 
+        recommendedProxySettings = true;
+      };
+    };
+
+    services.vaultwarden = {
+      enable = cfg.enable; 
+      backupDir = "/srv/data/vaultwarden";
+      config = {
+        DOMAIN=cfg.domain;
+        ROCKET_ADDRESS = "127.0.0.1";
+        ROCKET_PORT ="3222";
+        SIGNUPS_DOMAINS_WHITELIST=(lib.concatStringsSep "," cfg.signupWhitelist);
+        SIGNUPS_ALLOWED="false";
+        IP_HEADER="X-Forwarded-For";
+      }; 
+      environmentFile = config.sops.templates.vaultwardenEnvFile.path;
+    };
+    
+  }); 
+}