sagittarius: vaultwarden init

2 files changed, 38 insertions, 0 deletions

diff --git a/hosts/sagittarius/web/default.nix b/hosts/sagittarius/web/default.nix
index 2ccf36b..2424eaf 100644
--- a/hosts/sagittarius/web/default.nix
+++ b/hosts/sagittarius/web/default.nix
@@ -6,5 +6,6 @@
     ./git.nix
     ./static.nix
     ./navidrome.nix
+    ./vaultwarden.nix
   ];
 }
diff --git a/hosts/sagittarius/web/vaultwarden.nix b/hosts/sagittarius/web/vaultwarden.nix
new file mode 100644
index 0000000..d17e006
--- /dev/null
+++ b/hosts/sagittarius/web/vaultwarden.nix
@@ -0,0 +1,37 @@
+{ config, ... }:
+let
+  hostname = config.networking.hostName;
+  cfg = config.services.vaultwarden.config;
+in
+{
+  services.vaultwarden = {
+    enable = true;
+    configureNginx = false;
+    dbBackend = "sqlite";
+    # domain = "${hostname}.internal";
+    config = {
+      DOMAIN = "http://${hostname}.internal";
+      SIGNUPS_ALLOWED = true;
+
+      ROCKET_ADDRESS = "127.0.0.1";
+      ROCKET_PORT = 8222;
+      ROCKET_LOG = "critical";
+    };
+  };
+
+  services.nginx.virtualHosts."vaultwarden" = {
+    serverName = "${hostname}.internal";
+    listen = [
+      {
+        addr = "[2301:db8:acad:a::1]"; # TODO: extract from topology instead of hardcoding
+        port = 80;
+        ssl = false;
+      }
+    ];
+
+    locations."/" = {
+      proxyPass = "http://127.0.0.1:${toString cfg.ROCKET_PORT}";
+      recommendedProxySettings = true;
+    };
+  };
+}