From 645e86a443d3f74cc8f9c95cb433cbefed5263cb Mon Sep 17 00:00:00 2001
From: Jakub Stachurski <j.stachurski@student.utwente.nl>
Date: Sun, 25 Jan 2026 14:11:14 +0100
Subject: Inital commit for working omega-relay host.

This commit includes:
- Mysql module from umbriel
- Disko configuration for the Ferox VM
- Freshrss module
- Stalwart module
- Vaultwarden module
- Wakapi module
- Uptime Kuma module
- Support for using mysql socket
- Server user that does not depend on full home-manager preset.
- ACME for wilkuu.xyz domains, including all the services.
---
 services/vaultwarden.nix | 76 ++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 76 insertions(+)
 create mode 100644 services/vaultwarden.nix

(limited to 'services/vaultwarden.nix')

diff --git a/services/vaultwarden.nix b/services/vaultwarden.nix
new file mode 100644
index 0000000..f68a2fa
--- /dev/null
+++ b/services/vaultwarden.nix
@@ -0,0 +1,76 @@
+{config, pkgs, lib, ...}: 
+let
+  cfg = config.wilkuu.services.vaultwarden; 
+  hostname = config.networking.hostName; 
+in 
+{
+  options.wilkuu.services.vaultwarden = with lib; {
+    domain = mkOption {
+      type = types.str; 
+      default = "bitwarden.${hostname}.local"; 
+      example = "bitwarden.wilkuu.xyz"; 
+      description = "Domain for http connections.";  
+    };  
+    doACME = mkEnableOption "Enable ACME for vaultwarden here";
+    enable = mkEnableOption "Enable the vaultwarden service"; 
+    backupDir = mkOption { 
+     type = types.path; 
+     description = "Storage localtion for Vaultwarden user data backup";
+     default = "/srv/data/vaultwarden";
+     example = "/srv/data/vaultwarden";
+    }; 
+    signupWhitelist = mkOption {
+      type = types.listOf types.str; 
+      default = []; 
+      example = ["wilkuu.xyz"]; 
+      description = "Domains that can sign up on vaultwarden";
+    }; 
+  };
+
+  config = lib.mkIf cfg.enable (let 
+    sopsPath = ../secrets/${hostname}/vaultwarden.yaml;
+    secrets = ["admin_token"]; 
+    toSops  = (sname: "vaultwarden/${sname}");
+    toCredfilePath = (name: config.sops.secrets.${toSops name}.path); 
+  in {
+     networking.hosts = {
+      "127.0.0.1" = [cfg.domain];
+     };
+
+    sops.secrets = 
+      (lib.genAttrs (map toSops secrets) 
+        (name: {
+          sopsFile = sopsPath; 
+          mode = "0440"; 
+          owner = "vaultwarden";  
+        }));   
+
+    sops.templates.vaultwardenEnvFile.content = ''
+      ADMIN_TOKEN=${config.sops.placeholder."vaultwarden/admin_token"}
+    '';
+    
+    services.nginx.virtualHosts."${cfg.domain}" = {
+      enableACME = cfg.doACME;
+      addSSL = cfg.doACME; 
+      locations."/" = {
+        proxyPass = "http://localhost:3222"; 
+        recommendedProxySettings = true;
+      };
+    };
+
+    services.vaultwarden = {
+      enable = cfg.enable; 
+      backupDir = "/srv/data/vaultwarden";
+      config = {
+        DOMAIN=cfg.domain;
+        ROCKET_ADDRESS = "127.0.0.1";
+        ROCKET_PORT ="3222";
+        SIGNUPS_DOMAINS_WHITELIST=(lib.concatStringsSep "," cfg.signupWhitelist);
+        SIGNUPS_ALLOWED="false";
+        IP_HEADER="X-Forwarded-For";
+      }; 
+      environmentFile = config.sops.templates.vaultwardenEnvFile.path;
+    };
+    
+  }); 
+}
-- 
cgit v1.3.1