From 04707c728441000d64d3d750916354310ff2d2ab Mon Sep 17 00:00:00 2001
From: Jakub Stachurski <jakub@wilkuu.xyz>
Date: Wed, 11 Feb 2026 15:35:44 +0100
Subject: Omega-Relay host replacement for Ubuntu VM on Feox

* Add omega-relay prototype host

* Add omega-relay prototype host

* Inital commit for working omega-relay host.

This commit includes:
- Mysql module from umbriel
- Disko configuration for the Ferox VM
- Freshrss module
- Stalwart module
- Vaultwarden module
- Wakapi module
- Uptime Kuma module
- Support for using mysql socket
- Server user that does not depend on full home-manager preset.
- ACME for wilkuu.xyz domains, including all the services.

* Nix fmt

* Fixes in secrets and services.

Mostly fixes connection to mysql and the unix-socket auth for it.

* Little fixes and update

* Format and do fixes

* Update secrets and keys for omega-relay

* Apply changes from messing around and making things work
---
 services/vaultwarden.nix | 78 ++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 78 insertions(+)
 create mode 100644 services/vaultwarden.nix

(limited to 'services/vaultwarden.nix')

diff --git a/services/vaultwarden.nix b/services/vaultwarden.nix
new file mode 100644
index 0000000..ff3466d
--- /dev/null
+++ b/services/vaultwarden.nix
@@ -0,0 +1,78 @@
+{ config, lib, ... }:
+let
+  cfg = config.wilkuu.services.vaultwarden;
+  hostname = config.networking.hostName;
+in
+{
+  options.wilkuu.services.vaultwarden = with lib; {
+    domain = mkOption {
+      type = types.str;
+      default = "bitwarden.${hostname}.local";
+      example = "bitwarden.wilkuu.xyz";
+      description = "Domain for http connections.";
+    };
+    doACME = mkEnableOption "Enable ACME for vaultwarden here";
+    enable = mkEnableOption "Enable the vaultwarden service";
+    backupDir = mkOption {
+      type = types.path;
+      description = "Storage localtion for Vaultwarden user data backup";
+      default = "/srv/data/vaultwarden";
+      example = "/srv/data/vaultwarden";
+    };
+    signupWhitelist = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+      example = [ "wilkuu.xyz" ];
+      description = "Domains that can sign up on vaultwarden";
+    };
+  };
+
+  config = lib.mkIf cfg.enable (
+    let
+      sopsPath = ../secrets/${hostname}/vaultwarden.yaml;
+      secrets = [ "admin_token" ];
+      toSops = (sname: "vaultwarden/${sname}");
+    in
+    {
+      networking.hosts = {
+        "127.0.0.1" = [ cfg.domain ];
+      };
+
+      sops.secrets = (
+        lib.genAttrs (map toSops secrets) (_name: {
+          sopsFile = sopsPath;
+          mode = "0440";
+          owner = "vaultwarden";
+        })
+      );
+
+      sops.templates.vaultwardenEnvFile.content = ''
+        ADMIN_TOKEN=${config.sops.placeholder."vaultwarden/admin_token"}
+      '';
+
+      services.nginx.virtualHosts."${cfg.domain}" = {
+        enableACME = cfg.doACME;
+        addSSL = cfg.doACME;
+        locations."/" = {
+          proxyPass = "http://localhost:3222";
+          recommendedProxySettings = true;
+        };
+      };
+
+      services.vaultwarden = {
+        enable = cfg.enable;
+        # backupDir = cfg.backupDir;
+        config = {
+          DOMAIN = "${if cfg.doACME then "https" else "http"}://${cfg.domain}";
+          ROCKET_ADDRESS = "127.0.0.1";
+          ROCKET_PORT = "3222";
+          SIGNUPS_DOMAINS_WHITELIST = (lib.concatStringsSep "," cfg.signupWhitelist);
+          SIGNUPS_ALLOWED = "false";
+          IP_HEADER = "X-Forwarded-For";
+        };
+        environmentFile = config.sops.templates.vaultwardenEnvFile.path;
+      };
+
+    }
+  );
+}
-- 
cgit v1.3.1