blob: 4aa24ba7226bfe9e0e3b5c10bfeea2f624891953 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
|
{ config, lib, ... }:
let
cfg = config.wilkuu.services.vaultwarden;
hostname = config.networking.hostName;
in
{
options.wilkuu.services.vaultwarden = with lib; {
domain = mkOption {
type = types.str;
default = "bitwarden.${hostname}.local";
example = "bitwarden.wilkuu.xyz";
description = "Domain for http connections.";
};
doACME = mkEnableOption "Enable ACME for vaultwarden here";
enable = mkEnableOption "Enable the vaultwarden service";
backupDir = mkOption {
type = types.path;
description = "Storage localtion for Vaultwarden user data backup";
default = "/srv/data/vaultwarden";
example = "/srv/data/vaultwarden";
};
signupWhitelist = mkOption {
type = types.listOf types.str;
default = [ ];
example = [ "wilkuu.xyz" ];
description = "Domains that can sign up on vaultwarden";
};
};
config = lib.mkIf cfg.enable (
let
sopsPath = ../secrets/${hostname}/vaultwarden.yaml;
secrets = [ "admin_token" ];
toSops = (sname: "vaultwarden/${sname}");
in
{
networking.hosts = {
"127.0.0.1" = [ cfg.domain ];
};
sops.secrets = (
lib.genAttrs (map toSops secrets) (_name: {
sopsFile = sopsPath;
mode = "0440";
owner = "vaultwarden";
})
);
sops.templates.vaultwardenEnvFile.content = ''
ADMIN_TOKEN=${config.sops.placeholder."vaultwarden/admin_token"}
'';
services.nginx.virtualHosts."${cfg.domain}" = {
enableACME = cfg.doACME;
addSSL = cfg.doACME;
locations."/" = {
proxyPass = "http://localhost:3222";
recommendedProxySettings = true;
};
};
services.vaultwarden = {
enable = cfg.enable;
backupDir = "/srv/data/vaultwarden";
config = {
DOMAIN = cfg.domain;
ROCKET_ADDRESS = "127.0.0.1";
ROCKET_PORT = "3222";
SIGNUPS_DOMAINS_WHITELIST = (lib.concatStringsSep "," cfg.signupWhitelist);
SIGNUPS_ALLOWED = "false";
IP_HEADER = "X-Forwarded-For";
};
environmentFile = config.sops.templates.vaultwardenEnvFile.path;
};
}
);
}
|
