sid/sid.ovh
1
0
Fork 0
Code Issues 3 Pull requests 2 Projects Releases Packages Wiki Activity Actions

rm coredns and step-ca. use hs extra dns records. resolve vaultwarden

Browse source
This commit is contained in:
sid 2026-05-17 22:44:00 +02:00
parent 1bb2b7c194
commit 41ce9b892b
10 changed files with 73 additions and 36 deletions
Download patch file Download diff file Expand all files Collapse all files

47
hosts/rx4/services/vaultwarden.nix
View file

@ -6,6 +6,7 @@
let
inherit (constants) domain;
inherit (constants.hosts.rx4) ip;
inherit (constants.services.vaultwarden) fqdn port;
in
{
@ -21,6 +22,7 @@ in
environmentFile = [ config.sops.templates."vaultwarden/env-file".path ];
config = {
ENABLE_WEBSOCKET = true;
SIGNUPS_ALLOWED = false;
SMTP_FROM = "vaultwarden@${domain}";
@ -30,12 +32,50 @@ in
SMTP_SECURITY = "starttls";
SMTP_USERNAME = "vaultwarden@${domain}";
ROCKET_ADDRESS = "0.0.0.0";
ROCKET_ADDRESS = "127.0.0.1";
ROCKET_PORT = port;
ROCKET_LOG = "critical";
};
};
services.nginx.virtualHosts."${fqdn}" = {
useACMEHost = "pw-custom";
forceSSL = true;
listen = [
{
addr = "${ip}:443";
ssl = true;
}
];
locations = {
"/" = {
proxyPass = "http://127.0.0.1:${toString port}";
};
"= /notifications/alerts" = {
proxyPass = "http://127.0.0.1:${toString port}";
proxyWebsockets = true;
};
"= /notifications/hub" = {
proxyPass = "http://127.0.0.1:${toString port}";
proxyWebsockets = true;
};
};
};
security.acme = {
acceptTerms = true;
defaults.email = "admin@${domain}";
certs."pw-custom" = {
domain = fqdn;
dnsProvider = "hetzner";
dnsResolver = "1.1.1.1:53";
credentialFiles = {
HETZNER_API_TOKEN_FILE = config.sops.secrets.hetzner-api-key.path;
};
group = "nginx";
};
};
sops =
let
owner = config.users.users.vaultwarden.name;
@ -50,6 +90,11 @@ in
"vaultwarden/smtp-password" = {
inherit owner group mode;
};
hetzner-api-key = {
inherit mode;
owner = "acme";
group = "acme";
};
};
templates = {
"vaultwarden/env-file" = {