infrastructure/machines/nixos/compute01/vaultwarden.nix
Tom Hubrecht ecbad0a638
All checks were successful
Check workflows / check_workflows (push) Successful in 21s
Run pre-commit on all files / check (push) Successful in 24s
Check meta / check_dns (pull_request) Successful in 19s
Check meta / check_meta (pull_request) Successful in 18s
Check workflows / check_workflows (pull_request) Successful in 19s
Build all the nodes / bridge01 (pull_request) Successful in 1m13s
Build all the nodes / geo01 (pull_request) Successful in 1m14s
Build all the nodes / compute01 (pull_request) Successful in 1m44s
Build all the nodes / geo02 (pull_request) Successful in 1m12s
Build all the nodes / rescue01 (pull_request) Successful in 1m30s
Build all the nodes / storage01 (pull_request) Successful in 1m29s
Build all the nodes / vault01 (pull_request) Successful in 1m26s
Build all the nodes / web02 (pull_request) Successful in 1m19s
Run pre-commit on all files / check (pull_request) Successful in 24s
Build all the nodes / web01 (pull_request) Successful in 1m56s
Build all the nodes / web03 (pull_request) Successful in 1m25s
chore: Abstract machines and modules
This adds subdirectories for the different types of systems, for the
modules and the machines
2024-12-08 13:39:10 +01:00

72 lines
1.7 KiB
Nix

{ config, ... }:
let
host = "pass.dgnum.eu";
port = 10501;
wsPort = 10500;
in
{
services.vaultwarden = {
enable = true;
config = {
DOMAIN = "https://${host}";
WEBSOCKET_ENABLED = true;
WEBSOCKET_PORT = wsPort;
SIGNUPS_DOMAINS_WHITELIST = "dgnum.eu,ens.fr,ens.psl.eu";
ROCKET_PORT = port;
ROCKET_ADDRESS = "127.0.0.1";
SIGNUPS_VERIFY = true;
USE_SYSLOG = true;
DATABASE_URL = "postgresql://vaultwarden?host=/run/postgresql";
SMTP_USERNAME = "web-services@infra.dgnum.eu";
SMTP_FROM = "noreply@infra.dgnum.eu";
SMTP_FROM_NAME = "DGNum Vault";
SMTP_PORT = 465;
SMTP_HOST = "kurisu.lahfa.xyz";
SMTP_SECURITY = "force_tls";
};
dbBackend = "postgresql";
environmentFile = config.age.secrets."vaultwarden-environment_file".path;
};
dgn-web = {
internalPorts.vaultwarden-websockets = wsPort;
simpleProxies.vaultwarden = {
inherit host port;
proxyWebsockets = true;
vhostConfig.locations = {
"/notifications/hub" = {
proxyPass = "http://127.0.0.1:${builtins.toString port}";
proxyWebsockets = true;
};
"/notifications/hub/negotiate" = {
proxyPass = "http://127.0.0.1:${builtins.toString wsPort}";
proxyWebsockets = true;
};
};
};
};
services.postgresql = {
enable = true;
ensureDatabases = [ "vaultwarden" ];
ensureUsers = [
{
name = "vaultwarden";
ensureDBOwnership = true;
}
];
};
dgn-backups.jobs.vaultwarden.settings.paths = [ "/var/lib/bitwarden_rs" ];
dgn-backups.postgresDatabases = [ "vaultwarden" ];
}