mirrors_public/oddlama_nix-config
1
1
Fork 1
mirror of https://github.com/oddlama/nix-config.git synced 2025-10-10 23:00:39 +02:00
Code Activity

feat: wip: add container backend to guests

Browse source
This commit is contained in:
oddlama 2023-12-17 02:04:20 +01:00
parent 83f1908e21
commit abb8330d86
No known key found for this signature in database
GPG key ID: 14EFE510775FE39A
23 changed files with 256 additions and 208 deletions
Download patch file Download diff file Expand all files Collapse all files

93
hosts/ward/guests/vaultwarden.nix Normal file
View file

@ -0,0 +1,93 @@
{
config,
lib,
nodes,
...
}: let
sentinelCfg = nodes.sentinel.config;
vaultwardenDomain = "pw.${sentinelCfg.repo.secrets.local.personalDomain}";
in {
meta.wireguard-proxy.sentinel.allowedTCPPorts = [
config.services.vaultwarden.config.rocketPort
config.services.vaultwarden.config.websocketPort
];
age.secrets.vaultwarden-env = {
rekeyFile = config.node.secretsDir + "/vaultwarden-env.age";
mode = "440";
group = "vaultwarden";
};
nodes.sentinel = {
networking.providedDomains.vaultwarden = vaultwardenDomain;
services.nginx = {
upstreams.vaultwarden = {
servers."${config.meta.wireguard.proxy-sentinel.ipv4}:${toString config.services.vaultwarden.config.rocketPort}" = {};
extraConfig = ''
zone vaultwarden 64k;
keepalive 2;
'';
};
upstreams.vaultwarden-websocket = {
servers."${config.meta.wireguard.proxy-sentinel.ipv4}:${toString config.services.vaultwarden.config.websocketPort}" = {};
extraConfig = ''
zone vaultwarden-websocket 64k;
keepalive 2;
'';
};
virtualHosts.${vaultwardenDomain} = {
forceSSL = true;
useACMEWildcardHost = true;
extraConfig = ''
client_max_body_size 256M;
'';
locations."/".proxyPass = "http://vaultwarden";
locations."/notifications/hub" = {
proxyPass = "http://vaultwarden-websocket";
proxyWebsockets = true;
};
locations."/notifications/hub/negotiate" = {
proxyPass = "http://vaultwarden";
proxyWebsockets = true;
};
};
};
};
services.vaultwarden = {
enable = true;
dbBackend = "sqlite";
config = {
dataFolder = lib.mkForce "/var/lib/vaultwarden";
extendedLogging = true;
useSyslog = true;
webVaultEnabled = true;
websocketEnabled = true;
websocketAddress = "0.0.0.0";
websocketPort = 3012;
rocketAddress = "0.0.0.0";
rocketPort = 8012;
signupsAllowed = false;
passwordIterations = 1000000;
invitationsAllowed = true;
invitationOrgName = "Vaultwarden";
domain = "https://${vaultwardenDomain}";
smtpEmbedImages = true;
smtpSecurity = "force_tls";
smtpPort = 465;
};
#backupDir = "/data/backup";
environmentFile = config.age.secrets.vaultwarden-env.path;
};
# Replace uses of old name
systemd.services.backup-vaultwarden.environment.DATA_FOLDER = lib.mkForce "/var/lib/vaultwarden";
systemd.services.vaultwarden.serviceConfig = {
StateDirectory = lib.mkForce "vaultwarden";
RestartSec = "600"; # Retry every 10 minutes
};
}