83 lines
2.1 KiB
Nix
83 lines
2.1 KiB
Nix
# yanked from @fufexan
|
|
{
|
|
config,
|
|
self,
|
|
lib,
|
|
...
|
|
}: let
|
|
inherit (config.networking) domain;
|
|
inherit (lib) mkIf mkEnableOption;
|
|
vcfg = config.services.vaultwarden.config;
|
|
cfg = config.server.vaultwarden;
|
|
in {
|
|
options = {
|
|
server.vaultwarden = {
|
|
enable = mkEnableOption "Enables vaultwarden";
|
|
url = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = "vault.${cfg.domain}";
|
|
};
|
|
cloudflared = {
|
|
credentialsFile = lib.mkOption {
|
|
type = lib.types.str;
|
|
example = lib.literalExpression ''
|
|
pkgs.writeText "cloudflare-credentials.json" '''
|
|
{"AccountTag":"secret"."TunnelSecret":"secret","TunnelID":"secret"}
|
|
'''
|
|
'';
|
|
};
|
|
tunnelId = lib.mkOption {
|
|
type = lib.types.str;
|
|
example = "00000000-0000-0000-0000-000000000000";
|
|
};
|
|
};
|
|
};
|
|
};
|
|
|
|
config = mkIf cfg.enable {
|
|
server = {
|
|
fail2ban = lib.mkIf config.server.fail2ban.enable {
|
|
jails = {
|
|
vaultwarden = {
|
|
serviceName = "vaultwarden";
|
|
failRegex = "^.*Username or password is incorrect. Try again. IP: <HOST>. Username: <F-USER>.*</F-USER>.$";
|
|
};
|
|
};
|
|
};
|
|
};
|
|
|
|
services = {
|
|
vaultwarden = {
|
|
enable = true;
|
|
environmentFile = config.age.secrets.vaultwarden-env.path;
|
|
|
|
backupDir = "/var/backup/vaultwarden";
|
|
|
|
config = {
|
|
DOMAIN = "https://vault.${domain}";
|
|
SIGNUPS_ALLOWED = false;
|
|
ROCKET_ADDRESS = "127.0.0.1";
|
|
ROCKET_PORT = 8222;
|
|
IP_HEADER = "CF-Connecting-IP";
|
|
|
|
logLevel = "warn";
|
|
extendedLogging = true;
|
|
useSyslog = true;
|
|
invitationsAllowed = false;
|
|
showPasswordHint = false;
|
|
};
|
|
};
|
|
cloudflared = {
|
|
enable = true;
|
|
tunnels.${cfg.cloudflared.tunnelId} = {
|
|
credentialsFile = cfg.cloudflared.credentialsFile;
|
|
default = "http_status:404";
|
|
ingress."${cfg.url}".service = "http://${vcfg.ROCKET_ADDRESS}:${
|
|
toString vcfg.ROCKET_PORT
|
|
}";
|
|
};
|
|
};
|
|
};
|
|
};
|
|
}
|