mirror of
https://forge.katzen.cafe/schrottkatze/nix-configs.git
synced 2024-11-05 23:26:23 +01:00
meow set up vaultwarden
This commit is contained in:
parent
b6670bcd1a
commit
b159ff8c4b
17
flake.nix
17
flake.nix
|
@ -54,6 +54,23 @@
|
||||||
nixos-hardware.nixosModules.apple-t2
|
nixos-hardware.nixosModules.apple-t2
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
|
schrottserver = nixpkgs.lib.nixosSystem {
|
||||||
|
specialArgs = {
|
||||||
|
inherit inputs;
|
||||||
|
};
|
||||||
|
system = "x86_64-linux";
|
||||||
|
modules = [
|
||||||
|
./schrottserver/configuration.nix
|
||||||
|
home-manager.nixosModules.home-manager {
|
||||||
|
home-manager.useGlobalPkgs = true;
|
||||||
|
home-manager.useUserPackages = true;
|
||||||
|
home-manager.users.jade = { nixosConfig, pkgs, ... }: {
|
||||||
|
home.sessionVariables.TZ = nixosConfig.time.timeZone;
|
||||||
|
home.stateVersion = "${nixosConfig.system.stateVersion}";
|
||||||
|
};
|
||||||
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
35
schrottserver/configuration.nix
Normal file
35
schrottserver/configuration.nix
Normal file
|
@ -0,0 +1,35 @@
|
||||||
|
# Edit this configuration file to define what should be installed on
|
||||||
|
# your system. Help is available in the configuration.nix(5) man page
|
||||||
|
# and in the NixOS manual (accessible by running ‘nixos-help’).
|
||||||
|
|
||||||
|
{ inputs, config, pkgs, ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
imports =
|
||||||
|
[ # Include the results of the hardware scan.
|
||||||
|
./hardware-configuration.nix
|
||||||
|
../common.nix
|
||||||
|
./proxy.nix
|
||||||
|
./vaultwarden.nix
|
||||||
|
];
|
||||||
|
|
||||||
|
jade = {
|
||||||
|
neovim.enable = true;
|
||||||
|
zsh.enable = true;
|
||||||
|
};
|
||||||
|
|
||||||
|
# Use the GRUB 2 boot loader.
|
||||||
|
boot.loader.grub.enable = true;
|
||||||
|
boot.loader.grub.version = 2;
|
||||||
|
boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only
|
||||||
|
|
||||||
|
networking.hostName = "schrottserver"; # Define your hostname.
|
||||||
|
networking.networkmanager.enable = true; # Easiest to use and most distros use this by default.
|
||||||
|
|
||||||
|
networking.firewall.enable = false;
|
||||||
|
|
||||||
|
# default settings for stateful data; don't change unless reinstall with newer version
|
||||||
|
system.stateVersion = "22.11"; # Did you read the comment?
|
||||||
|
|
||||||
|
}
|
||||||
|
|
37
schrottserver/hardware-configuration.nix
Normal file
37
schrottserver/hardware-configuration.nix
Normal file
|
@ -0,0 +1,37 @@
|
||||||
|
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||||
|
# and may be overwritten by future invocations. Please make changes
|
||||||
|
# to /etc/nixos/configuration.nix instead.
|
||||||
|
{ config, lib, pkgs, modulesPath, ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
imports =
|
||||||
|
[ (modulesPath + "/profiles/qemu-guest.nix")
|
||||||
|
];
|
||||||
|
|
||||||
|
boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "sd_mod" "sr_mod" ];
|
||||||
|
boot.initrd.kernelModules = [ ];
|
||||||
|
boot.kernelModules = [ ];
|
||||||
|
boot.extraModulePackages = [ ];
|
||||||
|
|
||||||
|
fileSystems."/" =
|
||||||
|
{ device = "/dev/disk/by-uuid/e8d88849-3746-4c24-9ecd-09921645ef81";
|
||||||
|
fsType = "ext4";
|
||||||
|
};
|
||||||
|
|
||||||
|
fileSystems."/boot" =
|
||||||
|
{ device = "/dev/disk/by-uuid/0107-0E2C";
|
||||||
|
fsType = "vfat";
|
||||||
|
};
|
||||||
|
|
||||||
|
swapDevices = [ ];
|
||||||
|
|
||||||
|
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||||
|
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||||
|
# still possible to use this option, but it's recommended to use it in conjunction
|
||||||
|
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||||
|
networking.useDHCP = lib.mkDefault true;
|
||||||
|
# networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
|
||||||
|
|
||||||
|
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||||
|
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||||
|
}
|
44
schrottserver/proxy.nix
Normal file
44
schrottserver/proxy.nix
Normal file
|
@ -0,0 +1,44 @@
|
||||||
|
{ inputs, config, pkgs, ... }:
|
||||||
|
let
|
||||||
|
domain = "schrottkatze.de";
|
||||||
|
vaultwardenSubdomain = "vw";
|
||||||
|
in {
|
||||||
|
security.acme = {
|
||||||
|
acceptTerms = true;
|
||||||
|
defaults.email = "jade@schrottkatze.de";
|
||||||
|
certs = {
|
||||||
|
"${vaultwardenSubdomain}.${domain}" = {
|
||||||
|
group = "nginx";
|
||||||
|
keyType = "rsa2048";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
services.nginx = {
|
||||||
|
enable = true;
|
||||||
|
|
||||||
|
recommendedGzipSettings = true;
|
||||||
|
recommendedOptimisation = true;
|
||||||
|
recommendedProxySettings = true;
|
||||||
|
recommendedTlsSettings = true;
|
||||||
|
|
||||||
|
virtualHosts = {
|
||||||
|
"${vaultwardenSubdomain}.${domain}" = {
|
||||||
|
forceSSL = true;
|
||||||
|
enableACME = true;
|
||||||
|
locations."/" = {
|
||||||
|
proxyPass = "http://localhost:8812"; #changed the default rocket port due to some conflict
|
||||||
|
proxyWebsockets = true;
|
||||||
|
};
|
||||||
|
locations."/notifications/hub" = {
|
||||||
|
proxyPass = "http://localhost:3012";
|
||||||
|
proxyWebsockets = true;
|
||||||
|
};
|
||||||
|
locations."/notifications/hub/negotiate" = {
|
||||||
|
proxyPass = "http://localhost:8812";
|
||||||
|
proxyWebsockets = true;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
31
schrottserver/vaultwarden.nix
Normal file
31
schrottserver/vaultwarden.nix
Normal file
|
@ -0,0 +1,31 @@
|
||||||
|
{ pkgs, ... }:
|
||||||
|
{
|
||||||
|
services.vaultwarden = {
|
||||||
|
enable = true;
|
||||||
|
#backupDir = "/vw-backups";
|
||||||
|
config = {
|
||||||
|
#WEB_VAULT_FOLDER = "${pkgs.vaultwarden}/share/vaultwarden/vault";
|
||||||
|
#WEB_VAULT_ENABLED = true;
|
||||||
|
DATA_FOLDER = "/var/lib/bitwarden_rs/";
|
||||||
|
DATABASE_URL = "/var/lib/bitwarden_rs/db.sqlite3";
|
||||||
|
LOG_FILE = "/var/log/bitwarden";
|
||||||
|
WEBSOCKET_ENABLED = true;
|
||||||
|
WEBSOCKET_ADDRESS = "0.0.0.0";
|
||||||
|
WEBSOCKET_PORT = 3012;
|
||||||
|
SIGNUPS_VERIFY = true;
|
||||||
|
ROCKET_LOG = "debug";
|
||||||
|
ENABLE_WAL = false;
|
||||||
|
ADMIN_TOKEN = builtins.readFile ../secret-data/vaultwarden-admin-token;
|
||||||
|
DOMAIN = "http://localhost";
|
||||||
|
#SMTP_HOST = "mx.example.com";
|
||||||
|
#SMTP_FROM = "bitwarden@example.com";
|
||||||
|
#SMTP_FROM_NAME = "Bitwarden_RS";
|
||||||
|
#SMTP_PORT = 587;
|
||||||
|
#SMTP_SSL = true;
|
||||||
|
#SMTP_USERNAME = (import /etc/nixos/secret/bitwarden.nix).SMTP_USERNAME;
|
||||||
|
#SMTP_PASSWORD = (import /etc/nixos/secret/bitwarden.nix).SMTP_PASSWORD;
|
||||||
|
SMTP_TIMEOUT = 15;
|
||||||
|
ROCKET_PORT = 8812;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
BIN
secret-data/vaultwarden-admin-token
Normal file
BIN
secret-data/vaultwarden-admin-token
Normal file
Binary file not shown.
Loading…
Reference in a new issue