feat: add vaultwarden

Signed-off-by: Chinmay D. Pai <chinmay.pai@zerodha.com>

machines/trench/default.nix

@@ -4,9 +4,11 @@
     ../../modules/commons
     ../../modules/nixos/core-server.nix
     ../../modules/nixos/user-group.nix
+    ../../modules/programs/nginx.nix
     ../../modules/programs/nixvim
     ../../modules/programs/nomad
     ../../modules/programs/gitea
+    ../../modules/programs/vaultwarden
   ];
 
   environment.systemPackages = with pkgs; [tailscale];

modules/programs/gitea/default.nix

@@ -66,17 +66,7 @@ in {
   };
   users.groups.git = {};
 
-  security.acme = {
-    acceptTerms = true;
-    email = "chinmaydpai@gmail.com";
-  };
   services.nginx = {
-    enable = true;
-    recommendedProxySettings = true;
-    recommendedOptimisation = true;
-    recommendedGzipSettings = true;
-    recommendedTlsSettings = true;
-
     virtualHosts = {
       "${domain}" = {
         serverName = "${domain}";

modules/programs/nginx.nix

@@ -0,0 +1,14 @@
+{...}: {
+  security.acme = {
+    acceptTerms = true;
+    email = "chinmaydpai@gmail.com";
+  };
+
+  services.nginx = {
+    enable = true;
+    recommendedProxySettings = true;
+    recommendedOptimisation = true;
+    recommendedGzipSettings = true;
+    recommendedTlsSettings = true;
+  };
+}

modules/programs/vaultwarden/default.nix

@@ -0,0 +1,52 @@
+{
+  config,
+  pkgs,
+  ...
+}: let
+  domain = "bw.deku.moe";
+in {
+  age.secrets.vaultwarden = {
+    file = ../../../secrets/vaultwarden.age;
+    owner = "vaultwarden";
+    group = "vaultwarden";
+  };
+
+  services.vaultwarden = {
+    enable = true;
+    package = pkgs.vaultwarden;
+
+    environmentFile = config.age.secrets.vaultwarden.path;
+    dbBackend = "postgresql";
+
+    config = {
+      domain = "https://${domain}";
+      signupsAllowed = false;
+
+      rocketAddress = "127.0.0.1";
+      rocketPort = 33003;
+
+      databaseUrl = "postgres:///vaultwarden?host=/var/run/postgresql";
+    };
+  };
+
+  services.postgresql.ensureDatabases = ["vaultwarden"];
+  services.postgresql.ensureUsers = [
+    {
+      name = "vaultwarden";
+      ensureDBOwnership = true;
+    }
+  ];
+
+  services.nginx = {
+    virtualHosts = {
+      "${domain}" = {
+        serverName = "${domain}";
+        enableACME = true;
+        forceSSL = true;
+        locations."/" = {
+          proxyPass = "http://127.0.0.1:${toString config.services.vaultwarden.config.rocketPort}/";
+        };
+      };
+    };
+  };
+}

secrets/secrets.nix

@@ -10,4 +10,5 @@ let
   users = thunderbottom ++ codingcoffee;
 in {
   "gitea.age".publicKeys = users ++ servers;
+  "vaultwarden.age".publicKeys = users ++ servers;
 }