From dcd2c4c4d71161301a956b7e4777b499f5010e74 Mon Sep 17 00:00:00 2001
From: Isabella Bastaja <isabella@sorre.xyz>
Date: Tue, 18 Aug 2026 20:07:35 +0200
Subject: tower: init

---
 hosts/tower/web/vaultwarden.nix | 41 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 41 insertions(+)
 create mode 100644 hosts/tower/web/vaultwarden.nix

(limited to 'hosts/tower/web/vaultwarden.nix')

diff --git a/hosts/tower/web/vaultwarden.nix b/hosts/tower/web/vaultwarden.nix
new file mode 100644
index 0000000..68bb1cd
--- /dev/null
+++ b/hosts/tower/web/vaultwarden.nix
@@ -0,0 +1,41 @@
+{ config, ... }:
+let
+  cfg = config.services.vaultwarden.config;
+  # secrets = config.sops.secrets;
+  domain = "vaultwarden.sorre.internal";
+in
+{
+  services.vaultwarden = {
+    enable = true;
+    configureNginx = false;
+    dbBackend = "sqlite";
+    inherit domain;
+    config = {
+      SIGNUPS_ALLOWED = false;
+
+      ROCKET_ADDRESS = "127.0.0.1";
+      ROCKET_PORT = 8222;
+      ROCKET_LOG = "critical";
+    };
+  };
+
+  services.nginx.virtualHosts."vaultwarden" = {
+    serverName = domain;
+    # forceSSL = true;
+    listen = [
+      {
+        addr = "100.64.0.3";
+        port = 443;
+        # ssl = true;
+      }
+    ];
+
+    # sslCertificateKey = secrets."wg-ca-key".path;
+    # sslCertificate = secrets."wg-ca-crt".path;
+
+    locations."/" = {
+      proxyPass = "http://127.0.0.1:${toString cfg.ROCKET_PORT}";
+      recommendedProxySettings = true;
+    };
+  };
+}
-- 
cgit v1.3.1