From 644b4843185d7bca9e1ccd0db20b762b0116899b Mon Sep 17 00:00:00 2001
From: Isabella Bastaja <isabella@sorre.xyz>
Date: Sat, 30 May 2026 20:19:07 +0200
Subject: sagittarius: vaultwarden init

---
 hosts/sagittarius/web/vaultwarden.nix | 37 +++++++++++++++++++++++++++++++++++
 1 file changed, 37 insertions(+)
 create mode 100644 hosts/sagittarius/web/vaultwarden.nix

(limited to 'hosts/sagittarius/web/vaultwarden.nix')

diff --git a/hosts/sagittarius/web/vaultwarden.nix b/hosts/sagittarius/web/vaultwarden.nix
new file mode 100644
index 0000000..d17e006
--- /dev/null
+++ b/hosts/sagittarius/web/vaultwarden.nix
@@ -0,0 +1,37 @@
+{ config, ... }:
+let
+  hostname = config.networking.hostName;
+  cfg = config.services.vaultwarden.config;
+in
+{
+  services.vaultwarden = {
+    enable = true;
+    configureNginx = false;
+    dbBackend = "sqlite";
+    # domain = "${hostname}.internal";
+    config = {
+      DOMAIN = "http://${hostname}.internal";
+      SIGNUPS_ALLOWED = true;
+
+      ROCKET_ADDRESS = "127.0.0.1";
+      ROCKET_PORT = 8222;
+      ROCKET_LOG = "critical";
+    };
+  };
+
+  services.nginx.virtualHosts."vaultwarden" = {
+    serverName = "${hostname}.internal";
+    listen = [
+      {
+        addr = "[2301:db8:acad:a::1]"; # TODO: extract from topology instead of hardcoding
+        port = 80;
+        ssl = false;
+      }
+    ];
+
+    locations."/" = {
+      proxyPass = "http://127.0.0.1:${toString cfg.ROCKET_PORT}";
+      recommendedProxySettings = true;
+    };
+  };
+}
-- 
cgit v1.3.1