services/vaultwarden: init

hosts/caramel/default.nix

@@ -6,6 +6,7 @@
   age.secrets = {
     acme_dns.file = ../../secrets/acme_dns.age;
     passwd.file = ../../secrets/passwd.age;
+    warden_admin.file = ../../secrets/warden_admin.age;
     wpa_conf.file = ../../secrets/wpa_conf.age;
     wg_caramel.file = ../../secrets/wg_caramel.age;
   };
@@ -33,5 +34,6 @@
       synapse
       tmptsync
       unbound
+      vaultwarden
     ]);
 }

modules/default.nix

@@ -20,6 +20,7 @@ in {
     ./services/synapse.nix
     ./services/tmptsync.nix
     ./services/unbound.nix
+    ./services/vaultwarden.nix
   ];
   system = mkAttrsFromPaths [
     ./system/audio.nix

modules/services/unbound.nix

@@ -28,6 +28,11 @@ in {
           "10.0.0.0/8       allow"
           "192.168.100.0/24 allow"
         ];
+        domain-insecure = [ "local.lava.moe" ];
+        local-zone = [ "local.lava.moe. redirect" ];
+        local-data = [
+          "warden.local.lava.moe. IN A 192.168.100.15"
+        ];
       };
 
       include = "${inputs.hosts-blocklists}/unbound/unbound.blacklist.conf";

modules/services/vaultwarden.nix

@@ -0,0 +1,31 @@
+{ config, ... }:
+let
+  dir = "/persist/vaultwarden";
+  user = config.users.users.vaultwarden.name;
+  group = config.users.groups.vaultwarden.name;
+in {
+  systemd.tmpfiles.rules = [
+    "d ${dir} 700 ${user} ${group}"
+    "d ${dir}_backup 700 ${user} ${group}"
+  ];
+  services.vaultwarden = {
+    backupDir = "${dir}_backup";
+    config = {
+      dataFolder = dir;
+      signupsAllowed = false;
+      rocketPort = 8002;
+    };
+    domain = "warden.local.lava.moe";
+    environmentFile = config.age.secrets.warden_admin.path;
+  };
+
+  services.nginx.virtualHosts."warden.local.lava.moe" = {
+    forceSSL = true;
+    useACMEHost = "lava.moe";
+
+    locations."/".proxyPass = "http://[::1]:8002";
+  };
+
+  systemd.services.vaultwarden.serviceConfig.ReadWritePaths = [ dir ];
+  systemd.services.backup-vaultwarden.environment.DATA_FOLDER = dir;
+}

secrets.nix

@@ -9,6 +9,7 @@ in {
   "secrets/wpa_conf.age".publicKeys = [ blossom caramel rin ];
 
   "secrets/acme_dns.age".publicKeys = [ caramel rin ];
+  "secrets/warden_admin.age".publicKeys = [ caramel rin ];
   "secrets/wg_blossom.age".publicKeys = [ blossom rin ];
   "secrets/wg_caramel.age".publicKeys = [ caramel rin ];
   "secrets/wg_sugarcane.age".publicKeys = [ sugarcane rin ];

secrets/warden_admin.age

@@ -0,0 +1,10 @@
+age-encryption.org/v1
+-> ssh-ed25519 U9FXlg YL/xEUVIIOIeP2FRVxZhkCg/yaiX50S74HSMslKzoSw
+SqzuQt4hd6ICDRlq+6Vqy0j/ZuNm3waCg7pUt9EqVD0
+-> ssh-ed25519 krYeuQ IsFu0w7BFrTm5rAE6Ysxuievf3NiC60h/KkoUO51FUA
+/BCYR/4qP+1449Kf2MY79sq0ahpjqI5fq7Sme2swU6U
+-> V;-grease ^F.M
+lxjBnTXUAhPceJGeXm985SzVP4D2PsxkUEv/kKSx+6LGCHUzYAggYXi8C2ahorkY
+XrYNvorBDG0aezi2GSicmAf4pQkkrLcvZhsmU+/QOKzyAxMw7V0
+--- jUlhN0y3o/J/jQlcN0um+lTQ3hZv2Ur0crxSsGeZ28c
+ºDJ?…w䟆9%s5ÕzüÈ­k<C2AD>¢ÒõŒˆA›3U"»V3Î[ŒinÊå<C38A>0÷¹Ù’¿k’”Óø°X„Íøôi°:­LÇÆo¹aDºé'$Oý<4F>54õ&Õ<>Þ²‘ ˆÎ^–UL±
EQP¶Ïû/