From 8f137c28230623259a964484adcf31fe00756594 Mon Sep 17 00:00:00 2001
From: Azat Bahawi <azat@bahawi.net>
Date: Sat, 17 Dec 2022 16:39:09 +0300
Subject: 2022-12-17

---
 modules/nixos/vaultwarden.nix | 134 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 134 insertions(+)
 create mode 100644 modules/nixos/vaultwarden.nix

(limited to 'modules/nixos/vaultwarden.nix')

diff --git a/modules/nixos/vaultwarden.nix b/modules/nixos/vaultwarden.nix
new file mode 100644
index 0000000..7d51667
--- /dev/null
+++ b/modules/nixos/vaultwarden.nix
@@ -0,0 +1,134 @@
+{
+  config,
+  inputs,
+  lib,
+  ...
+}:
+with lib; let
+  cfg = config.nixfiles.modules.vaultwarden;
+in {
+  options.nixfiles.modules.vaultwarden = {
+    enable = mkEnableOption "Vaultwarden";
+
+    domain = mkOption {
+      description = "Domain name sans protocol scheme.";
+      type = with types; str;
+      default = "vaultwarden.${config.networking.domain}";
+    };
+  };
+
+  config = let
+    db = "vaultwarden";
+  in
+    mkIf cfg.enable {
+      secrets.vaultwarden-environment = {
+        file = "${inputs.self}/secrets/vaultwarden-environment";
+        owner = "vaultwarden";
+        group = "vaultwarden";
+      };
+
+      nixfiles.modules = {
+        nginx = {
+          enable = true;
+          upstreams = with config.services.vaultwarden.config; {
+            vaultwarden_rocket.servers."${ROCKET_ADDRESS}:${toString ROCKET_PORT}" = {};
+            vaultwarden_websocket.servers."${WEBSOCKET_ADDRESS}:${toString WEBSOCKET_PORT}" = {};
+          };
+          virtualHosts.${cfg.domain} = {
+            locations."/" = {
+              proxyPass = "http://vaultwarden_rocket";
+              proxyWebsockets = true;
+            };
+            locations."/notifications/hub" = {
+              proxyPass = "http://vaultwarden_websocket";
+              proxyWebsockets = true;
+            };
+            locations."/notifications/hub/negotiate" = {
+              proxyPass = "http://vaultwarden_rocket";
+              proxyWebsockets = true;
+            };
+          };
+        };
+        postgresql = {
+          enable = true;
+          extraPostStart = [
+            ''
+              $PSQL "${db}" -tAc 'GRANT ALL ON SCHEMA "public" TO "${db}"'
+            ''
+          ];
+        };
+      };
+
+      services = {
+        vaultwarden = {
+          enable = true;
+          config = {
+            TZ = config.time.timeZone;
+
+            WEB_VAULT_ENABLED = true;
+
+            DOMAIN = optionalString (cfg.domain != null) "http://${cfg.domain}";
+
+            SIGNUPS_ALLOWED = false;
+            INVITATIONS_ALLOWED = false;
+
+            ORG_CREATION_USERS = "none";
+
+            PASSWORD_HINTS_ALLOWED = false;
+            SHOW_PASSWORD_HINT = false;
+
+            ROCKET_ADDRESS = "127.0.0.1";
+            ROCKET_PORT = 8812;
+
+            WEBSOCKET_ENABLED = true;
+            WEBSOCKET_ADDRESS = "127.0.0.1";
+            WEBSOCKET_PORT = 8813;
+
+            LOG_LEVEL = "error";
+
+            DATABASE_URL = "postgresql://${db}@/${db}";
+          };
+          dbBackend = "postgresql";
+          environmentFile = config.secrets.vaultwarden-environment.path;
+        };
+
+        postgresql = {
+          ensureDatabases = [db];
+          ensureUsers = [
+            {
+              name = db;
+              ensurePermissions."DATABASE \"${db}\"" = "ALL";
+            }
+          ];
+        };
+
+        fail2ban.jails = mkIf config.nixfiles.modules.fail2ban.enable {
+          vaultwarden = ''
+            enabled = true
+            filter = vaultwarden
+            port = http,https
+          '';
+          vaultwarden-admin = ''
+            enabled = true
+            filter = vaultwarden-admin
+            port = http,https
+          '';
+        };
+      };
+
+      environment.etc = mkIf config.nixfiles.modules.fail2ban.enable {
+        "fail2ban/filter.d/vaultwarden.conf".text = ''
+          [Definition]
+          failregex = ^.*Username or password is incorrect\. Try again\. IP: <ADDR>\. Username:.*$
+          ignoreregex =
+          journalmatch = _SYSTEMD_UNIT=vaultwarden.service
+        '';
+        "fail2ban/filter.d/vaultwarden-admin.conf".text = ''
+          [Definition]
+          failregex = ^.*Invalid admin token\. IP: <ADDR>.*$
+          ignoreregex =
+          journalmatch = _SYSTEMD_UNIT=vaultwarden.service
+        '';
+      };
+    };
+}
-- 
cgit 1.4.1