From 50c3646e5b1049f411250a0873ab9c1c8d7ed4bb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Patrick=20Gro=C3=9Fmann?= Date: Fri, 12 Jan 2024 17:16:37 +0100 Subject: [PATCH] feat: vaultwarden config --- hosts/elisabeth/guests.nix | 21 +++++++ .../secrets/nextcloud/option.json.age | Bin 0 -> 1032 bytes .../secrets/vaultwarden/vaultwarden-env.age | Bin 0 -> 952 bytes modules/config/users.nix | 1 + modules/services/vaultwarden.nix | 55 ++++++++++++++++++ secrets/secrets.nix.age | Bin 4635 -> 4662 bytes 6 files changed, 77 insertions(+) create mode 100644 hosts/elisabeth/secrets/nextcloud/option.json.age create mode 100644 hosts/elisabeth/secrets/vaultwarden/vaultwarden-env.age create mode 100644 modules/services/vaultwarden.nix diff --git a/hosts/elisabeth/guests.nix b/hosts/elisabeth/guests.nix index febc144..4ed3527 100644 --- a/hosts/elisabeth/guests.nix +++ b/hosts/elisabeth/guests.nix @@ -10,11 +10,31 @@ adguardhomedomain = "adguardhome.${config.secrets.secrets.global.domains.web}"; nextclouddomain = "nc.${config.secrets.secrets.global.domains.web}"; giteadomain = "git.${config.secrets.secrets.global.domains.web}"; + vaultwardendomain = "pw.${config.secrets.secrets.global.domains.web}"; ipOf = hostName: lib.net.cidr.host config.secrets.secrets.global.net.ips."${config.guests.${hostName}.nodeName}" config.secrets.secrets.global.net.privateSubnet; in { services.nginx = { enable = true; recommendedSetup = true; + upstreams.vaultwarden = { + servers."${ipOf "vaultwarden"}:3000" = {}; + + extraConfig = '' + zone vaultwarden 64k ; + keepalive 5 ; + ''; + }; + virtualHosts.${vaultwardendomain} = { + forceSSL = true; + useACMEHost = "web"; + locations."/" = { + proxyPass = "http://vaultwarden"; + proxyWebsockets = true; + }; + extraConfig = '' + client_max_body_size 1G ; + ''; + }; upstreams.gitea = { servers."${ipOf "gitea"}:3000" = {}; @@ -141,6 +161,7 @@ in { in {} // mkContainer "adguardhome" {} + // mkContainer "vaultwarden" {} // mkContainer "nextcloud" { enablePanzer = true; } diff --git a/hosts/elisabeth/secrets/nextcloud/option.json.age b/hosts/elisabeth/secrets/nextcloud/option.json.age new file mode 100644 index 0000000000000000000000000000000000000000..18de8987075e6749aef66ffefcaec1df4289eb25 GIT binary patch literal 1032 zcmY+=du$U00LO79W9f=G4H=@#LKP>0(On;Ry=yY3*T=1E*Y?_8d)J#WTf4jKwRdgr zvFjrXE)X*v2|8gw44MtXHZ~+;LWmI(XEFsNt3gagSWLi;P0;|NAq*5BiGS?>U-HTC z+s!dXCYzK?d6my)n{zS;XlA{!)j(Mw$ZR(dnE>aHwj%)^Oeoe|6A}s8v8;ul5v-RC zLTr*V#~oe|uZfDDAcJv)L<=&Nq8Zjr**eTcE{Z8}QZb3BUnvDO!a{I4jr0F2|Cdr%ey6G;iiGWxvg@QYCz z64MaTZdUwWI%3wE%zPVy3E@zgw+MOJmKGBcj$38X7{|9445&2=Yk=gTq#PNB-3XF5 zQ8pWx;E@zi&SqjL<7Fu)uS6Y0PR}wp%XMI`2!je?j22)|z|N&qu+&C}@>#?NNG_KP z4hV82zRH3$5m!S7RPCj#qEE0m?PWYmxM>GzPOt<>m0~1cC=xst=l~K>l2$XKUPaY7 zTZ+&?N{OS1oF@*5xDY1YaBtA$^P=980Q#*+hP9&LD(nAWO-hku(Z5LoSO45GAL{&B-Fr6GULWV9Ki z+=tIRlICLd(_LI><;Ke^ zQ?Gx}zmC#L_?G=AZk>$2w!OCQ>+yGly3WNlSD8OXmmYJ$6KmJfP4vWl&wTNA*RrYl z-o3+b?(D!jVX$sb^zNxaW}$O4z9SZ$b@es64i2{rrY}6zR=wDI?O1*J=DF{df{iuF zE1K`G@ppwQy4vLJ+Bu3Gsu@{P<*i-s!MX|g6W!-$2md^!9%;oVrgvA4-`u=!VCa>- zw~#$gJpBkCtNAn|w7d^|Rv#;F`*nT)Y}?VsgX_PTP6vla_ zvB7?Jd1D1gzkRas^N_t>+|YMtruw7f&l@Gt`=DV{MfZ)cY5%2QzW literal 0 HcmV?d00001 diff --git a/hosts/elisabeth/secrets/vaultwarden/vaultwarden-env.age b/hosts/elisabeth/secrets/vaultwarden/vaultwarden-env.age new file mode 100644 index 0000000000000000000000000000000000000000..1ee2049a5d09380f1558245962da699e516b1293 GIT binary patch literal 952 zcmY+<>uVbY00407aIjD+xDP6d1d0rrW$7ikJP?PM+$Fioy>iJVcdu7kjx)3&Ly%Y7ytam5GJ1Y+99y=s<+k%0Bp^f5DGmO%j8m zCYVzlTh_H*x+#Smz!%)@=fWTeB>kO=KqhfKZ-J3?R8R1E5HuOQTf{0fN3})RvXQzb zqNz!b@OgMx?J;#0uEq0Qp0B2@Jg&y=aE)xC9E&4xCF#Y`@kGvH?+YE-33kF@%+Hky zlPu(iRHB#ZRmvcxla-=tSID>!ld&lTvY?zH%1xY!V0c#px<=g>B^bDstB@HTZ<7tV z%5fZA29mh|ZZrz6XVNT+G;_sl7`8T9)r=>{)0x3Bw44r6l3tQIU|bu8Jljd@7Vg z@?AHd(i=SFMj9f;WPEP5Vr4S1Ou0@m)t;W?5uUajl~r4W0%WT;7*Qk_qB*?cZn8i} zrR{B_H=87^!FgaEXWP357CTpA`Wk{#Wks&xFpklyR>^j1@<*Ly}(S}Pc z6AnO@qIzm61{J6Xo2GbKF2GpB#E4DS|1UF3tJQK50;*a=F9*bUtF1zkIL>Bi*|0sZwEIu4hY+a9jl{~ulX8NG^=R-S}79TJ#pi9@@ebsyC z^^IS(XZNG?=a^emJE>8QeCZ@OXcZ=tw-iOzp`=Ed8`%BHmpU-~x;QEh!{e5b7 zFnt3bdS-NH_!^1MJ-vE+ZGCQJX)7}P(?#JC;Nv@pl2w%_4$j_+jLMnQ<=^6i;LM?g zx4zsC{Iz4>-L*g7?mxeWUyF`TdvEOhA$ECX;_;^*JNv14di&8mCx=cd=a#Fpr;fe$ z1#{-afw4zV0LQ=G*4@~$I^#S!_V<;GM+Pg0hmj=U2YD`mg3* VB9E+o)Kd13EqucE3*5c%+zXli9KLq~dgM=yC;GdFg4IAUXUcW*^;X9_Jo zAaH4REpRe5HXvA3QEOE}AVG0ecR^JzIcs%dacEXBc{oi*Mt@~TR!eJlSX4<)O-^b! zWm9TeZERIxVpIxhH)KU+Vr)llVRkEQN=+|kdPQq+b2MvjcUp0IV@g$XZf;^qIa6n7 zW?2d?J|J*ub}eu+H8vnxMrUbBcOXG}aA+}2PFGEKF*i_dF=tmu0*Sw&AdXgO^wQ)E?fP(eWoEj}P{ zX?87eGBq|JT1IDSNp~PYY)x%-RWN2uM=*GJL1u7aWJXJWQdMwSdTUW}X-6wjVM%B+ zN_A;vX=QS53OIC9O>$a6X+ttkWL0D^bYn(NW@J`EbxT2FYEL*$MP@d3MN~B~F*#vT z3N1b$GdnY3SVwd^EoX9NVRK~)Pj^meO-W2uV{BAGNN!3nP)>YL(2hrV-+gnXZ!_@?fdr#}0+jc&;Bxogj<BmfOg2R4nU1=5sfB?JasQFg&+9t^qh61s_k3L%v(Wd5t?AXt?;pjKh zyfAH{JF5MKxWY)1{CwrhVl>kxG9dDN{im8IIXT@PW1?yqD`#Z^!5M2u= zz_5fhhW3w4vG(B&6`Ivf+X+4Cz^Y5?%x@$mq6x=4mzVP~ioR`#p zH}zXrYpSO%I^|9OJZ-Y&o%YK%SC+^^x@T{^^>jPiDk6|FC8Jc+6FW3PsyrpNcqEO5 z+|!RkHlWILXE+mMcwd=M@UA(XUS9MPfaQ5KrL|BcN;p^R5M?E5cT+b9!k{%`$)~$2 zC^r<+mH>ucK$&7_ZE+LrP*oe-R)TSVy=UsUgOS`Kor*qJf0sP=41$yzF>4#Y28*Zx z!kHlexA)h@N$oBrDc|{?b{2R}ifR0IE}oDbwkOPj1E7@@I{6WnPyK@GQfZ4Mf0*Hc?jt25|2peP2}yQFr~+>GE%bqx0|Gd+v5SYl z>ekqNEI5S$Yv+xd0v05yx+J;p!}Aq z$8BjGvtPz(0jgOn(71YaLZ&T$QH0PMy;E&4QVpgHA@+`DdFz5n?6%;80I;H~7CH=D zoujXEl_~WxkBXH*^Qz(rpJ|YLf^-O;*_REXI-p)VzuMwH!t%&(Ce{wY&PGk{0=j&M zLW1x^fz?EJqN8ba#eUJ>{7KH_=o7z_wtbpz|?S+hG%B$CM!?Hq}^fvCmVf$f!KLCEjL(gg& zUPqemcXKD&yHWg{hxl?ATbMf^_#QrV`F~J6(Ypg5Y9l&UwRsP0Dw($qq}AlHfc{|_ z+vej;H+DMZ_V(~BcVnhiH%p@MN|64~iQu~!Qzo+`rD?$uZvbC^0RUr{;Lm)Wsq`cQ zn&OMO;lY}L2sd~o&?YO`g26(6+J3gz7xXM-vECnhDj)e_%?h(33?4NKDnJ1DG>jXZ z!8@kRRpjwJ<*za@D;Q0RPvq?Z+h+7rShAn-{A+_!97_F`0$C8)I-qSB)AB)i5qsZ` zuhWbE3xdv7n0FU{rdQiDRTo<%pU&2Sfsj1=w0I1$(5B2}&fGrFrgh7QXxH!xcTFdL z0ue4)p~^~OKr$I32h`JLJAmO5bKXfYO% zXP`A>kE>-@ZOSt`B2SYO{tu#3sUFRP3<3cp8^mLOAvh>qmP%5ha^=$25}sh0;$M6k zkp=AK;eD0m2Pm}mA}gV?tTH4&X(wg>{y<%CaxnbBLTX4*mN4M>pDQxr!vhUQ;*HNA z)?iJlZ(ol_D!x@R61}= zJL}4Sauk5YjVi$s{0NB~K2}6MOdh6rLFI+|W|UghHO8-tK<2ky5jY@+pv~+I_q^hs z&7!plEpMHe6v)O|+hPVgUi|V^(&qA%uAw9SB-yG&h&)OFKK2x#J)&+X3mpmNxiN=p z|CbN&7Rw-*M1T?R_T*U~ege*T(-9+L}*^-f%;D63 zoJ{?Nd)&%^I{nl<+cE{r=^-@v%^qzADA@sk&6s}%xX!E z7e&k|wKr>rteR1+=hxmG@@qX%;b?$=wMKBeL{k&a@x5^Bex$=u0=bMU{yb@hq7GC_ z`-X5%Xj^V5^^#R$OmR1|*G_r*D(4O-rMNtJ-4Ek^xPOx zf@_jg#~vsF%nIbp8gz53=c9T}9y-HF<>e$8<+G5ZY_a=aK?JFfq5rFY=1uD3a1%`j>BBJ;$X z?AmhmXVV)**ERy^I%8G54{onXwKOKer7?X4A*!G6)^WZO%5gh_CYwV{g~o<;`eIke zeg+AoaPY25OE2=@S||^HT87;A(v21p_G#t$=9N6^1x5Z7KFHXzH?14TDF@|d30NW! zf`gB~8%p8sYCq{36`8h$JL9n@K$pj-dxB($@0X0)u(muGw0`2takzHf_#hvF{PWlQ zW2(vN7}LfAPA;$ePv`IvV~4B$nCz2>X>CqXQKB)EaUaR|18LHK0wa<%x_1kLMj!yG z%RecuJFHg?0ft22{5QK&F+?oE#NIU=8~3qCw|x4S`X~E;31EIf&g6bvE+7EY*AHgK zfFQ{$@p50{+lXp2O)M@@b+bAtjsYb{kAAcDiODA1!z8sdwgb~?DTkdjo5YaM&bTGx zgc}mtqIF`uD;zU_J29U)WKeL`diLHD>;!=-sJULepcSHxc=7W~OqC+W{#W@CV9!tE z8ce_Mb>e7uyt*F;f!zPmz5CqYal5b)nU&-KkNa2sHwU( z#MpzWU!7q$x!SVymhAN-@YhB;AZTRkIYH0iuVax)`)k2}Kbfl)!`0j8ygYsA+I1;C zzf*l$Be4wU7pHgW=`PCx%?k7u7CM&ipUN{viGF~JBB3Xb@6P=kz5a!T(eJqMdKWoh z#Btnrp`<6RB|Xm-7)RY#G0wB@+>oO{>hA=exy+1eM2d)D@8Hur0S;^ZQIm#?1dUuW zq8;~~c+LEOL>k)@N!3EOh@|F)4uR(%T#vf-Af#3i$*bIhMWyS2$Q-hV%yjBf?jPlD zAT`CoYy-i{%8J?XwjqIngdzs?4%#it+CA#c94wiB?&mubEGX}VU1)xWRefa#MB#3K z$vIAy8Q0mwMekaegR;RG4TAVZx-+-aR28HcgX(5~fhJgERN+>7xi`G(B!_3$^qTr- zZEEt8m&{z5;hkL!jXZ>&S~Z2jqw7O`H3_Uywrc>>03ogP;7t){9%LN+aVLc~0PwsH z2je=VZ~|3?AcXf6)`w;@G55G21WY{CKFFPX9qjDxC|6t9GF}n&g~a62xj#lWD7Ncq z;@S>>WeiaB+V{akqw;axz(yin2fY^@3LdNPZ7cR^H{;Eu$Z}t-${}%o>=$>0XkH@GlT0_nOQ7zc z%0kCqU@E~H=&n=aCer@t!I-ONmR%bOpZ`vO%<_z-wmHVYq$g#X;~Z&94FK)sO?}O>vbjJ z`<%4V>v*(^FKF5fn1s{$XJHdeu+9$q401pXq`vpQkW&)yZPRVx&)L1Vruj$9jPZeg zxaCWTCL6xzcCos+^6MFqrcCKWxNZbNBH$>xWOT`q!*NtV&`|A$Jns0~HB@7| zRDy%QvgQw}%_zy8>74&%K+NLe?n(a}!Vn?TycCSe?wQ%H4WB3hGfieiLl_Y-MQ!As zH6TkmR+f@%?y^)5sP+ zFmDPiJ|J*ub}eu+H8vnxMrUbBcOXG`IdnBlLMusFQAA>HO)_(HW_C_#Vl;MSac)>I zF-}cRZB=w|QZac*GG;jnOG!#ePdQa@Qg?QDL~Jx!Qh94{LStb#Yguw?Q7dXoM>cOr zW-($+LvC4YP;qKwWo~geb7y%>IY(1DOKU|6Ej}P{ zX?87eGBq|JT1IDSNp~PYGH^v~LUKb|L1IQ|R#Y-YR#7#7Nl8vHb8JghL~~hha5ptL zVM0YuRc$p%3Qu-#d1q2WacXF9RAonUc~@jhMP_zSd0~1^ZbD~yVsk}EG)6QlNlzb7cy5LwZwTSY|mmQCV0tb3{g2XL3+hV>L%`GFUHTWmj!P zH#JInXm)IWR!Vj`cV=>NFIZ?~W@k+@H8eLiN;P6d3TR0&Pj@j=IcrmCD?@c{a5y(> zbaH13EiEk|MR`?eS#D4;YEnpLcSck*V@N?cHh5z(NkMgPQEym9L{V-qbV5xyQ&ndQ zfsg#5(frc^6P^q127z6~uo>j=FpJO}>QJg)$&1{7#%VnL5KQMrja<^&)^mp@S!GGP z_%Z&4@RD$e+zH3WwIdiPtD8%d$0p?Ze`eP03KO1=JYNdf`xu;&V%Qlc6Vz0QuB{(t z+(}za)Ci)Xm6X=64hpcn{q%_|cAsR5rk5g5afp5f?<~$CF;ZdDE+W*LDDtMNyBL;9 zVdPPNs3wN;4#+qid-Kl<+p~&g2Ut*Va*C40vx7wmM)pA}xcp7c&D{Yc8iKM5+KkjZ@7F~cT*e`l2+P@1yi2wbcFR*rSJLwj$!L;fg_ zbIkm*J7D+bGG#RS8`)LWLF8_{2_#j^R_e0hF22hEP~};PMq?>ST5toue7yl5p`^!! z*~h73J`e?HLzg* zuO}}kwjo;PP@Ussp*On?ROtufD&!+0FGBR)I+u{$SRKUM`naG%$A+f&-n#K>WBw&7$^c&1=}z;atj6)1_=o^biq5=&%| zvGdtD70p244k|jXo@tcv1Hy}1x_x7545MD_`!_W6#Ta>*OGct`S1_=D#QyV=7L?j7 z#F`Fg2Z9$N_rkfj?*DK$u6_jq>~UcA5SPNd6oYBKTP6rEPU za?Xj&Es!L!7sW5rxZSDRRX(+&_Jz+WmuPxF3IRZw(o6n|eWlZQg8Ji))A5RA@Z z^%sCK0zs8kZ4D8wAnfIT4W(FZG?3OWv(*}so5cvfUtUIAE|cYAY_}r$KRwpU4b_tG zSpB^*3I|<&thnxnpp?_ruW6}mE8?ipx#MTwA+%Rjzw#tq zqLb5u4Tj#;JihF;AE$~xABbGc*GI@Hw^{RduR&=bx-iTz0QzyO6cJV>-IK}n;9YZtTE6Xb1ySxQ(IKy9oUT;ehTb*7e znj9hAdGkMir!)?m**>k|vj{S#MrtLrh~EWgMBR04C^HeG^X5KjkV&KG zSy}BEH+Ty0asWGO4aG;h5sHGHQ1Ky zGX>d6-Fp>qh2YZhG#9Z9$mC9@$EaY^N}mLVoyN|1z3L6ko%ySC$(lpFJp0gzenw6PvY^4pq@$Vea#`#pXc1_Z!02;i$L`;Mf5mUW_F{834(|I`r5_*|pHpm9fhc=m z;J3w&Uhf|ntm^_3Fl4g!L$VKwAsSTEWyhhde#5pRQ~Cly8k^TsLZ{d1n3tSg7JL!& zS)FtW)&1RC&`}QgKG*oErqYkBzZx#pL~{d}JLz)9z1hvMaSm*lwZBwA9<9gwY#;}J zYa059@+{o_i7Bc+zPP}!mJ3#%{a8ArQa2IBp*6x+TeEzqluzI*v|BWa8T%;8f@BAk zXTInFS+<%mz*xII?JTuh!a8hBzllN_IJ|nXh)APpKr3hTZxpFyD z*ydn+{$$&m3MD8y*$7`=uBWF`V}mDug4{pnMwt=mNOwH9=PU;$e5D!Ry z>AkdSW-_tQ&G(@-V%2zQloaE8C`v77r&tsDvKqqJ0UOo~0RWhqG zrQusu80TRB>u&r&tYaY&PVsSnu>b3HH>i?~i*o7#wj&tSYV13D&vok@@g=GU&Bydl7SWZSqXXEa8kL8C&iCErgxf+=t-!P)VkV(Esq_lLXG2m|0f=e!6UK z^wilFnuu6kB_{~4OKzSb!bh8ls9$#g^2@cA5indV(zy{ zbEMj%RAID(gCd~%(bbY7`BAuaT}s6G7;p`)7a(}7cb%FSW3%;t!EC9lg6W$#;Eqy< zB`!(BwBTzTN%`G*l_DHyNK`BiLSUCdzL`at7Hk{ljD=YB=F6hN zjzBv=)i6#et&SL3vmhgIsMH1EPf<$dL@5HSCJCAvZRKD4wW}%64K^glck7Cd9 z`;Y8zeb?ClFWZu;5*>w=2?01;{xl6WTBil&?dMK^dlJAQN8?CTl5*;L4buT8`trXP zutnG_ZC^wlYG6an9hD}(1}vh9OVPQEht0%!raq3bK);#_qwgx}yp3T+Iv8r?p(vC6 zz!dT;T|xRT2+f2S&j5rTNzSQ5%jz8Ec~H0&>Ihzhmjl=12$qz%KbIb40TYcmLezT# zw;Z{DgI8iE_~IHov`TA3`U{f;;6U>LXiG-Z0bm=z$`R47X&dA6vcgI2|A{bwluwFg&YfA%dr>uoscsx4aODOUBQK3PzzdYKSwU43{VWw>MJZ zi~(-^G`j8PKHJolV*%O5B+hW$T=@*dH~@WrX>rllZ}AymJje;^iQL)(Q2c6;oQPILPfZP0Ozg&W2*KSNf|!b7b)g+qo8 zSs*j+iX1KPOrichQ#j5oB;aaiHdV?Oh!@gCi(12xqj*0DDBGcLA2of>b~_46**K?)ndjXDPY>ySrltEI3m+4brCj$#Xv|n6gzpIFAD)SpyG014yuz z?rk>H&ASXPKGRYD;qwnq{rGuZG8;F2SfeNLfPiMILuEF~C?@mTeak{CeX3=vG46wT2?&Fd!bhh4dQHB{$PH zFGCx0zC$AhVf8E7D^)vK2T;CQteOPzca~GHOlyt<4!EHw0o3kd_fvF0Ykg)+R8QtB L|HV7v=`Hht`d^Q2