feat: host vaultwarden

2026-02-23 15:59:16 +01:00
parent 62955d98e5
commit 74a742ded8
4 changed files with 53 additions and 0 deletions
@@ -0,0 +1,40 @@
+{
+  config,
+  ...
+}:
+let
+  domain = config.kekleo.domain;
+  vaultDomain = "bitwarden.${domain}";
+in
+{
+  services.vaultwarden = {
+    enable = true;
+    domain = vaultDomain;
+    environmentFile = config.sops.secrets.vaultwarden.path;
+    config = {
+      SIGNUPS_ALLOWED = false;
+
+      ROCKET_ADDRESS = "127.0.0.1";
+      ROCKET_PORT = 8222;
+      ROCKET_LOG = "critical";
+    };
+  };
+
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "admin@${domain}";
+  };
+
+  services.nginx = {
+    enable = true;
+
+    virtualHosts.${vaultDomain} = {
+      forceSSL = true;
+      enableACME = true;
+      locations."/" = {
+        proxyPass = "http://127.0.0.1:${toString config.services.vaultwarden.config.ROCKET_PORT}";
+        proxyWebsockets = true;
+      };
+    };
+  };
+}