feat: host vaultwarden

nixos/server/default.nix

@@ -7,6 +7,7 @@
     ./hardware-configuration.nix
     ./secrets
     ./dyndns
+    ./vaultwarden.nix
   ];
 
   kekleo.graphical = false;

nixos/server/secrets/default.nix

@@ -12,4 +12,9 @@
     sopsFile = ./dyndns.env;
     owner = config.systemd.services.dyndns.serviceConfig.User;
   };
+  sops.secrets.vaultwarden = {
+    format = "dotenv";
+    sopsFile = ./vaultwarden.env;
+    owner = config.systemd.services.vaultwarden.serviceConfig.User;
+  };
 }

nixos/server/secrets/vaultwarden.env

@@ -0,0 +1,7 @@
+ADMIN_TOKEN=ENC[AES256_GCM,data:DIH33/RioAcZVesw+5be4JK+7Jzu5S0qnHc7wsf7jwK2ZNfMDUycW5rSsgcrDNQciY+/4AK8c6a6DvMiLBqPOzi24uG6mdLT36yMvNDHP8Y8Mrfobyj1Rj03QrUUnl0+9IuBbZutBIzP2BGdQjdzB3UfEaGLaU3g,iv:sy4qxaPCEe4qC8r9kUM+DjNnl3haZoy1gqjEipQLia4=,tag:fWbSx3NV5yV2l2s1uiavXg==,type:str]
+sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGdGg4bG1CZFhvYjVDZ0ZO\nZGUxTXpEMTJ1OHdiRmE1cHNvSkJPVlNIaG1JCnBmbWptRDZ2MWJmQnlPd2tvSk5r\neXAxQnNaUFlKcXdGN1p0bG53UU0rMG8KLS0tIEVuWlkwcjZEdHJibmdSWjdHUGQ1\nNmpWeXRWeU9NY2xoRXkvT1lmcFdVVUkKSy0xXHQuha2xkRiV9JxqvJxNCBBHtHgs\nDhma7HCGHYrbFEWFIH7qvjdHG2FYf/UqQchoSFDGrDHTZtY+pYFujg==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_0__map_recipient=age1cma8j2jk0jmzgttjmqn06l87u4as9k46yzmvetflzqp995wzdsgsjppacx
+sops_lastmodified=2026-02-23T12:43:01Z
+sops_mac=ENC[AES256_GCM,data:3RpYLYzkbAHZ1umutT/1yBpqpbdDcAGPjG5ANAlCbPgapK82qqyf/aiaDaKzOL1OHAIhV0xlR1WLE10jtij6dVjiKezqzw+eruS7Jyi09GHOLLnPv2VskccVBwr0U8u+Z/QbxoI4BW8a2gt6gdyUkNzqPR+Adf9wDaORjlkCSwk=,iv:AsKzTvxW+h92zEcotNvyMrp7Hqvkca7QHK/BWwL8LYE=,tag:MOXySJ/SSvT4oa8Fempn2w==,type:str]
+sops_unencrypted_suffix=_unencrypted
+sops_version=3.11.0

nixos/server/vaultwarden.nix

@@ -0,0 +1,40 @@
+{
+  config,
+  ...
+}:
+let
+  domain = config.kekleo.domain;
+  vaultDomain = "bitwarden.${domain}";
+in
+{
+  services.vaultwarden = {
+    enable = true;
+    domain = vaultDomain;
+    environmentFile = config.sops.secrets.vaultwarden.path;
+    config = {
+      SIGNUPS_ALLOWED = false;
+
+      ROCKET_ADDRESS = "127.0.0.1";
+      ROCKET_PORT = 8222;
+      ROCKET_LOG = "critical";
+    };
+  };
+
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "admin@${domain}";
+  };
+
+  services.nginx = {
+    enable = true;
+
+    virtualHosts.${vaultDomain} = {
+      forceSSL = true;
+      enableACME = true;
+      locations."/" = {
+        proxyPass = "http://127.0.0.1:${toString config.services.vaultwarden.config.ROCKET_PORT}";
+        proxyWebsockets = true;
+      };
+    };
+  };
+}