blob: f68a2fa0e52a2f6a0b7a5a75ec5b55b5b9af2d01 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
|
{config, pkgs, lib, ...}:
let
cfg = config.wilkuu.services.vaultwarden;
hostname = config.networking.hostName;
in
{
options.wilkuu.services.vaultwarden = with lib; {
domain = mkOption {
type = types.str;
default = "bitwarden.${hostname}.local";
example = "bitwarden.wilkuu.xyz";
description = "Domain for http connections.";
};
doACME = mkEnableOption "Enable ACME for vaultwarden here";
enable = mkEnableOption "Enable the vaultwarden service";
backupDir = mkOption {
type = types.path;
description = "Storage localtion for Vaultwarden user data backup";
default = "/srv/data/vaultwarden";
example = "/srv/data/vaultwarden";
};
signupWhitelist = mkOption {
type = types.listOf types.str;
default = [];
example = ["wilkuu.xyz"];
description = "Domains that can sign up on vaultwarden";
};
};
config = lib.mkIf cfg.enable (let
sopsPath = ../secrets/${hostname}/vaultwarden.yaml;
secrets = ["admin_token"];
toSops = (sname: "vaultwarden/${sname}");
toCredfilePath = (name: config.sops.secrets.${toSops name}.path);
in {
networking.hosts = {
"127.0.0.1" = [cfg.domain];
};
sops.secrets =
(lib.genAttrs (map toSops secrets)
(name: {
sopsFile = sopsPath;
mode = "0440";
owner = "vaultwarden";
}));
sops.templates.vaultwardenEnvFile.content = ''
ADMIN_TOKEN=${config.sops.placeholder."vaultwarden/admin_token"}
'';
services.nginx.virtualHosts."${cfg.domain}" = {
enableACME = cfg.doACME;
addSSL = cfg.doACME;
locations."/" = {
proxyPass = "http://localhost:3222";
recommendedProxySettings = true;
};
};
services.vaultwarden = {
enable = cfg.enable;
backupDir = "/srv/data/vaultwarden";
config = {
DOMAIN=cfg.domain;
ROCKET_ADDRESS = "127.0.0.1";
ROCKET_PORT ="3222";
SIGNUPS_DOMAINS_WHITELIST=(lib.concatStringsSep "," cfg.signupWhitelist);
SIGNUPS_ALLOWED="false";
IP_HEADER="X-Forwarded-For";
};
environmentFile = config.sops.templates.vaultwardenEnvFile.path;
};
});
}
|
