fail2ban test 12

hosts/sobotka/server.nix

@@ -12,6 +12,10 @@
     };
     vaultwarden = {
       enable = true;
+      cloudflared = {
+        tunnelId = "c3f541cb-b97e-4766-ae16-a8d863a3eec8";
+        credentialsFile = config.age.secrets.vaultwardenCloudflared.path;
+      };
     };
   };
 }

modules/server/vaultwarden/default.nix

@@ -11,7 +11,23 @@
   cfg = config.server.vaultwarden;
 in {
   options = {
-    server.vaultwarden.enable = mkEnableOption "Enables vaultwarden";
+    server.vaultwarden = {
+      enable = mkEnableOption "Enables vaultwarden";
+      cloudflared = {
+        credentialsFile = lib.mkOption {
+          type = lib.types.str;
+          example = lib.literalExpression ''
+            pkgs.writeText "cloudflare-credentials.json" '''
+            {"AccountTag":"secret"."TunnelSecret":"secret","TunnelID":"secret"}
+            '''
+          '';
+          tunnelId = lib.mkOption {
+            type = lib.types.str;
+            example = "00000000-0000-0000-0000-000000000000";
+          };
+        };
+      };
+    };
   };
 
   config = mkIf cfg.enable {
@@ -39,7 +55,8 @@ in {
       };
     };
 
-    services.vaultwarden = {
+    services = {
+      vaultwarden = {
         enable = true;
         environmentFile = config.age.secrets.vaultwarden-env.path;
 
@@ -59,5 +76,16 @@ in {
           showPasswordHint = false;
         };
       };
+      cloudflared = {
+        enable = true;
+        tunnels.${cfg.cloudflared.tunnelId} = {
+          credentialsFile = cfg.cloudflared.credentialsFile;
+          default = "http_status:404";
+          ingress."${cfg.url}".service = "http://${vcfg.ROCKET_ADDRESS}:${
+            toString vcfg.ROCKET_PORT
+          }";
+        };
+      };
+    };
   };
 }

secrets/secrets.nix

@@ -13,4 +13,5 @@ in {
   "cloudflare-env.age".publicKeys = [cnst kima usobotka rsobotka];
   "vaultwarden-env.age".publicKeys = [cnst kima usobotka rsobotka];
   "cloudflareFirewallApiKey.age".publicKeys = [cnst kima usobotka rsobotka];
+  "vaultwardenCloudflared.age".publicKeys = [cnst kima usobotka rsobotka];
 }