c4patino/yumeami
1
0
Fork 0
Code Activity Actions

feat: added vaultwarden support

Browse source
This commit is contained in:
Ceferino Patino 2025-05-04 22:00:45 -05:00
commit 0affed18d5
Signed by: c4patino
SSH key fingerprint: SHA256:Wu+cU1t+7zVT9wzew/4meNmeulo66NzMqc22MdDBgXI
8 changed files with 69 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

BIN
secrets/crypt/secrets.json
View file

Binary file not shown.

8
secrets/sops/secrets.yaml
View file

@ -4,10 +4,6 @@ github:
runner: ENC[AES256_GCM,data:i+0mDBPrRxo6k7lrG5JfvPYPBhDuw69ubCY2M0MMZczu97b3QdnKZw==,iv:zOuGzA6M32u00MC+Cc1ypHBbQIWytUQEyJTUuHO0gSs=,tag:n08pp173HqF9eqmIxjzMAg==,type:str]
runner-oasys: ENC[AES256_GCM,data:s6DicaREOQ6hC9MIcw/PY6lX0PAcnoDzrKZDNJkDlNp9sYOskwDyLkpWbuakbl+kC9x9CjeP4608o7Gey/HTB74Veza689W4FMn+ySFD038ilU3AjzZLJffQl9/J,iv:j6RJ4PP6y/jsid0mvcn7re6stx8+QV5ci1s3kuAiVQI=,tag:6WUG9DKf5Sj+orJZSfC4Iw==,type:str]
nixpkgs-update: ENC[AES256_GCM,data:aTQC7w59Z0u4po3C7oWbIiWgahK9tOfQNwoQRKYgGSCMsCNq07E+mA==,iv:8Dyu1lJACYa6HnVcppkGr/1tcV8vMu7qQrdcXchhgkk=,tag:U8z64cxoPkSeV5gxDkC/KA==,type:str]
postgresql:
vaultwarden: ENC[AES256_GCM,data:hZJcZ8w2YT4SH4aLxnffoeuEyNnOISiGfidEHM4e/cFbbpvxna2R96h0aqg=,iv:YKvXB8IxDUeBeRQZNQrGfahLLswInzi5ZOZrMvpNq/I=,tag:Ak/NSwXjtuwthCIl+jyN8w==,type:str]
forgejo: ENC[AES256_GCM,data:f4NHIfVFnzJOoKKySrBKAj/2aWq0lz4zaWiyaUaR0ETOC2LcpMPZ9cgfDTs=,iv:Y1NaVqdHUewhpMc08ZpUBujx3iw0r2z8l0wXfaJ4E6Q=,tag:aS5H6YIDjovSmJUk6mVOWw==,type:str]
grafana: ENC[AES256_GCM,data:NyE0vaUi6ECgX0gMpx8qa5D4kRc6qpsiuVjPkh78q3+HuOs5AEPnpwf22kw=,iv:qp3Xx9NgxTBTkMJKHhnYmjckVzHjAuqgK3gCo7t8A60=,tag:cfzVUg89uO1urOKYDYQRhw==,type:str]
tailscale:
actions: ENC[AES256_GCM,data:2eIgnhfYt8ZSrEPZ2d7ynHU5WhB3DUnBSPjMx3tQaL6sxuOmHUN5NuLdL7aot/RWn/A9SMcDTJdsDAwo,iv:E04WX6G8M5n8x36YgyMT2lDzsPqluLSd1p4Q6UHbm4M=,tag:TJdJ+ioeitGf+MyapXqyPg==,type:str]
tsdproxy: ENC[AES256_GCM,data:FZNL/UATBqS/Wp2LyA+bvzivSk8yunywAyjUKxYrAWiMzxhooJDlkcY/MZnO4TlG2JIfX8i1BKyjGbpWyj8=,iv:ujv/yxbVkeeJkK9JoYnySvsbMIsbU1FN/TfqMz4fTmk=,tag:i7zE1J6Fh8MCB2LDbho0YQ==,type:str]
@ -52,7 +48,7 @@ sops:
ZUZQcjZod1orQ1VKaEJ0QjJIKzlOQzAKvhXUFxOP9UYoLfurNCuVB/1joob2oAB9
/wC3fMo0STB1oUTNr5r6liMfjzm8ZdbHolK1TzMkrePz6zznFkJL1w==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2025-05-05T01:34:07Z"
mac: ENC[AES256_GCM,data:NkZvdZco75WjtssAOzxjARduFW57MZDZmgR0U9+76aR6PDornheX0y6a/LQ0z7++l0yy1MO68QpvIolImdDvkGNyW/bvBQCQGMF94RXjtUKEcB9QbPYjb0csBTcuKBvJglmkQU+Jqk/qphiUnyBYiORepb9F9DC9VfuNQ5VGjQo=,iv:JMaOl4YYuyKdh6w6pM/WYZK3f/6x8RbwAskWlPDhn7U=,tag:qRFxMY50X981LcUD5QP+pA==,type:str]
lastmodified: "2025-05-05T03:20:09Z"
mac: ENC[AES256_GCM,data:oYq4IHWP/pysaQWdzTrVgppdQOlZ+aPYMaivYUfxPsP2UaMgn3CLfnvOWM/68xU3HzdkjFn0A51Q/25X42efs3jHTY72u7kdL3GfePsBdxNOAb1GMtd/QrmTDMizlfSBgb5IZhb/eQB2joMg8W/FYoWna/TgmwE+aXFQdBO5JSE=,iv:6df9ADqB2iQPymx29ptqe9aA8ncM1051NqdyfWonXKY=,tag:er4uJ36x1DlCfmtBgLp1qw==,type:str]
unencrypted_suffix: _unencrypted
version: 3.10.2

5
system/default.nix
View file

@ -98,6 +98,11 @@ in {
host = "chibi";
port = 5201;
};
vaultwarden = {
host = "shiori";
port = 5300;
};
};
unbound.dnsHost = "chibi";

2
system/hosts/shiori/default.nix
View file

@ -17,6 +17,8 @@
httpd.enable = true;
vaultwarden.enable = true;
samba.mounts = {
"shared" = "arisu";
};

4
system/secrets.nix
View file

@ -18,10 +18,6 @@ in {
secrets = {
"master-password" = {owner = c4patino.name;};
"postgresql/forgejo" = {owner = c4patino.name;};
"postgresql/grafana" = {owner = c4patino.name;};
"postgresql/vaultwarden" = {owner = c4patino.name;};
"github/auth" = {owner = c4patino.name;};
"github/runner" = {owner = c4patino.name;};
"github/runner-oasys" = {owner = c4patino.name;};

1
system/services/default.nix
View file

@ -9,5 +9,6 @@
./pm2.nix
./slurm.nix
./uptime-kuma.nix
./vaultwarden.nix
];
}

7
system/services/storage/postgresql.nix
View file

@ -21,7 +21,12 @@ in {
services = {
postgresql = {
enable = true;
settings.port = port;
enableTCPIP = true;
settings = {
port = port;
};
authentication = let
permissionEntries =
cfg.databases

53
system/services/vaultwarden.nix Normal file
View file

@ -0,0 +1,53 @@
{
pkgs,
lib,
config,
secrets,
...
}: let
inherit (lib) mkIf mkEnableOption filterAttrs head;
cfg = config.vaultwarden;
pgCfg = config.postgresql;
port = 5300;
resolveHostIP = node:
if builtins.hasAttr node config.devices
then config.devices.${node}.IP
else builtins.throw "Host '${node}' does not exist in the devices configuration.";
in {
options.vaultwarden.enable = mkEnableOption "vaultwarden";
config = mkIf cfg.enable {
services.vaultwarden = {
enable = true;
package = pkgs.vaultwarden-postgresql;
dbBackend = "postgresql";
config = {
DOMAIN = "http://vaultwarden.yumeami.sh";
SIGNUPS_ALLOWED = false;
SIGNUPS_VERIFY = false;
DATABASE_URL = let
ip =
pgCfg.databases
|> filterAttrs (host: dbs: lib.elem "vaultwarden" dbs)
|> lib.attrNames
|> head
|> resolveHostIP;
in ''postgresql://vaultwarden:${secrets.postgresql.vaultwarden}@${ip}:5600/vaultwarden'';
LOG_LEVEL = "Info";
ROCKET_ADDRESS = "0.0.0.0";
ROCKET_PORT = port;
ROCKET_LOG = "critical";
EXPERIMENTAL_CLIENT_FEATURE_FLAGS = "autofill-v2,extension-refresh,ssh-key-vault-item,ssh-agent";
};
};
networking.firewall.allowedTCPPorts = [port];
};
}