frieder.hannenheim/fruitbasket
1
0
Fork 0
forked from wurzel/fruitbasket
Code Pull requests Activity

vaultwarden: init module

Browse source
This commit is contained in:
Rouven Seifert 2023-07-04 14:20:55 +02:00
parent 2d431ff526
commit 18922904df
Signed by untrusted user: rouven.seifert
GPG key ID: B95E8FE6B11C4D09
3 changed files with 42 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

38
modules/vaultwarden.nix Normal file
View file

@ -0,0 +1,38 @@
{ config, ... }:
let
domain = "vault.${config.fsr.domain}";
in
{
sops.secrets."vaultwarden_env".owner = "vaultwarden";
services.vaultwarden = {
enable = true;
dbBackend = "postgresql";
environmentFile = config.sops.secrets."vaultwarden_env".path;
config = {
domain = "https://${domain}";
signupsAllowed = false;
# somehow this works
databaseUrl = "postgresql://vaultwarden@%2Frun%2Fpostgresql/vaultwarden";
rocketPort = 8000;
};
};
services.postgresql = {
enable = true;
ensureUsers = [
{
name = "vaultwarden";
ensurePermissions = {
"DATABASE vaultwarden" = "ALL PRIVILEGES";
};
}
];
ensureDatabases = [ "vaultwarden" ];
};
services.nginx.virtualHosts."${domain}" = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://127.0.0.1:${toString config.services.vaultwarden.config.rocketPort}";
};
};
}