From a04313de0fb846ac2ae0bc4fd9a97328c668c407 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Patrick=20Gro=C3=9Fmann?= Date: Mon, 29 Jan 2024 17:27:42 +0100 Subject: [PATCH] feat: distributed config feat: vaultwarden smtp config --- .../vaultwarden/generated/maddyPasswd.age | Bin 0 -> 725 bytes .../secrets/vaultwarden/vaultwarden-env.age | Bin 1098 -> 938 bytes modules/config/default.nix | 1 + modules/distributed-config.nix | 66 ++++++++++++++++++ modules/services/vaultwarden.nix | 31 +++++++- 5 files changed, 96 insertions(+), 2 deletions(-) create mode 100644 hosts/elisabeth/secrets/vaultwarden/generated/maddyPasswd.age create mode 100644 modules/distributed-config.nix diff --git a/hosts/elisabeth/secrets/vaultwarden/generated/maddyPasswd.age b/hosts/elisabeth/secrets/vaultwarden/generated/maddyPasswd.age new file mode 100644 index 0000000000000000000000000000000000000000..cd92789c9f54bb1271b925a501fdca08f3573623 GIT binary patch literal 725 zcmY+8v=jl>VG*Jk69KVfQ2(D8IGP+NmZ7^`qevUVpkJa(Lo zsJy_zs;uUcKD9U$sz@5fhFpMh)6ghO0ZUVv&|%u+)e_anfk3C8kCtuCZGh1U%M=_J z6g8$AP>!7$Ql1XY0K?1~=CfWyx3CehlfAC1pj0DL6>cl5NNd6M&7u@+-V{@4R_oO` zB<3qN(@39Xx4uM0ydk@!+=eGCG7pE_QH_ZSN}VtKWY?7JJOfs1>KRAuX=OWdkczQo4S^%ln>oskvbwn9e z!6?#HX=PJ-Z`0Kjql#kTHXvfJbkg|LCl#V$>nGzsdtq)mTanjcGZNs9_inx;vUG)dF6 zsZ1T{=>`*~AajGg44h*K>fJVQoOllOVfy035PjGQ#}rX^I3_q@r+e_>{(gY)Q6?&6tTf z(9KgChcY~jri?_u9I3@*9GUILVmFL)P?c1qIX=pPcEPJ^a)LSIlGm?nvar|{A`zg_ z;d~Ea`fWDuu(|*?ZITJAT@8yy$ssTpI2g*cB3aBg94Mu8jDuwwc*#)m9BG0y+n66U zm@y+wu*mBve8z4MB8F}S{Y}>YUtxyvhH7GEhJ)S!0Sj#x>d@V>oVA@6JP};3Og6K* zlFwk1RGqfwBE8(Vc!!b_e3Z@j4HdVuaRJO>npw^w9-@>OVxZOTTWx|UK63y}o1xJf z7{CjiS9&O5c#3{-)&qf}%VLLtr&C~SqFE!5GXE>u1Ujtca*(G95GmnYlT~VbSmX@^ zce^wp2L&dTPNxAV4myoY$L1n4LSeQ6$GK|R8)iwzpdjD%1+wNOU_2QIXzJcS$M*k9 zPoF-{tzNnH=*ka`cdvi{#q?X{srACn+kbu)Zr!u|+3lO*lW!j1wPWEo{QUbkyc4e@ zPrSIX_SD(khqg;oTd!Z*d0tPoPrv@`y1KmBe(BD8m$v+P5qSHY zem;8m#3f+gfE@%)gOMQdj^0 literal 1098 zcmZwC`%fDM007`EPK6rDMr0;LM+X_qoTZQJajkBX_IiDBJ$iS&wpKu{?Qy;9wY|32 z*CC0KNwT5QNnExVH?!;kB0dr^GqNmkZiBHQWP;8JY-S75F|&n0vXEuEAD8$SeEArT z)v(D(rX4f)yH9vR)ly0+K0HCXGX~qL5q^BOVD7pVvqR zs7W345pmk0wwNO&4)jSJ9H9lHhbWR573!i*B9V6Ex;P~;%=4}zW2pMC%7|h~632^I0UPaj4v8(`-egF=ebb8)OI1GrLRxqa6Vs_%9=+b-L z1q&%*=wlX?Pk3cQZ4n}7%9eI_k+~cJAd1QD2_;)d)(Szvq}I(MR3aZkjIivE8B``O zRpdz;({(uv&Vrbw6(WFwM!yLAOBl|gAskY=^zk$y{QpY_v?5-rRfu`~K1>P*XhSK; zkx)p=5nea}+npRPr6ir!@26BEVnXa`jAFcL7^Pi0UkWv%NHnZuBA6VO$yO+(cw(MH z#AbZ-$`Oi&%dkwARns!*Q~P#BI=w9_iAngJ7Fg#=ga7rSKoUxT7N7<7)3~uzFaS+h zrodSFya@=I+?-0I(WrB>XUH1|DcPG8eA-uKsYMZMm`H;77YRz-;yYUm7~l!O_jr zPXNKE;-I_w)=b?f%C!!wkW_}ws ze}ANU{m-^Kd`m;~Ir9Nkue5o~)WVU^qG#t9Cv8hN$!F>-q3(-4vwu%a5e-6eqTDk? zj-8o3yH3tHLc#6d^j8$Fl@D4P_6}Vt+gR0y?Wz1yE8b;o-3!N=d&l2>{@4P)uXwY1 z++l&7-5Tli;;SdG!-q#!em}akrtr_?{Y2r}pnre)>ZxXcj-qYZy`Q_MC#OE`J=BpO zvF{t0UOYB_9=vcxM7AL{b5GuW1=KfxGV*5oTDo!BmHVLc)K9hdDozhxdPA(e@!XCu z-7~@8md ((x._type or "") != "__distributed_config_empty")) + (map (x: x.value) defs); + }; + default = {_type = "__distributed_config_empty";}; + description = '' + Anything specified here will be forwarded to `${concatStringsSep "." path}` + on the given node. Forwarding happens as-is to the raw values, + so validity can only be checked on the receiving node. + ''; + }; + + forwardedOptions = [ + ["age" "secrets"] + ["services" "maddy" "ensureCredentials"] + ]; + + attrsForEachOption = f: (foldl' (acc: path: recursiveUpdate acc (setAttrByPath path (f path))) {} forwardedOptions); +in { + options.nodes = mkOption { + description = "Options forwareded to the given node."; + default = {}; + type = types.attrsOf (types.submodule { + options = attrsForEachOption mkForwardedOption; + }); + }; + + config = let + mergeConfigFromOthers = let + getConfig = path: otherNode: let + cfg = nodes.${otherNode}.config.nodes.${nodeName} or null; + in + optionals (cfg != null) (getAttrFromPath path cfg); + in + path: mkMerge (concatMap (getConfig path) (attrNames nodes)); + in + attrsForEachOption mergeConfigFromOthers; +} diff --git a/modules/services/vaultwarden.nix b/modules/services/vaultwarden.nix index f281847..1600528 100644 --- a/modules/services/vaultwarden.nix +++ b/modules/services/vaultwarden.nix @@ -1,6 +1,7 @@ { config, lib, + nodes, ... }: let vaultwardenDomain = "pw.${config.secrets.secrets.global.domains.web}"; @@ -51,6 +52,29 @@ in { ]; }; }; + age.secrets.maddyPasswd = { + generator.script = "alnum"; + group = "vaultwarden"; + }; + + nodes.maddy = { + age.secrets.vaultwardenPasswd = { + inherit (config.age.secrets.maddyPasswd) rekeyFile; + inherit (nodes.maddy.config.services.maddy) group; + mode = "640"; + }; + services.maddy.ensureCredentials = { + "vaultwarden@${config.secrets.secrets.global.domains.mail_public}".passwordFile = nodes.maddy.config.age.secrets.vaultwardenPasswd.path; + }; + }; + system.activationScripts.systemd_env_smtp_passwd = { + text = '' + echo "SMTP_PASSWORD=$(< ${lib.escapeShellArg config.age.secrets.maddyPasswd.path})" > /run/vaultwarden_smtp_passwd + ''; + deps = ["agenix"]; + }; + + systemd.services.vaultwarden.serviceConfig.EnvironmentFile = ["/run/vaultwarden_smtp_passwd"]; services.vaultwarden = { enable = true; @@ -71,9 +95,12 @@ in { invitationOrgName = "Vaultwarden"; domain = "https://${vaultwardenDomain}"; - smtpEmbedImages = true; - smtpSecurity = "force_tls"; + smtpHost = "smtp.${config.secrets.secrets.global.domains.mail_public}"; + smtpFrom = "vaultwarden@${config.secrets.secrets.global.domains.mail_public}"; smtpPort = 465; + smtpSecurity = "force_tls"; + smtpUsername = "vaultwarden@${config.secrets.secrets.global.domains.mail_public}"; + smtpEmbedImages = true; }; environmentFile = config.age.secrets.vaultwarden-env.path; };