From 0affed18d577c3082aed57f36962fe8d74405b08 Mon Sep 17 00:00:00 2001 From: C4 Patino Date: Sun, 4 May 2025 22:00:45 -0500 Subject: [PATCH] feat: added vaultwarden support --- secrets/crypt/secrets.json | Bin 1052 -> 1259 bytes secrets/sops/secrets.yaml | 8 +--- system/default.nix | 5 +++ system/hosts/shiori/default.nix | 2 + system/secrets.nix | 4 -- system/services/default.nix | 1 + system/services/storage/postgresql.nix | 7 +++- system/services/vaultwarden.nix | 53 +++++++++++++++++++++++++ 8 files changed, 69 insertions(+), 11 deletions(-) create mode 100644 system/services/vaultwarden.nix diff --git a/secrets/crypt/secrets.json b/secrets/crypt/secrets.json index eee8fbf7b01f266eaf8205244255c7f17bb7f446..c5c6780099389c48eafb5325b27433108c8b968a 100644 GIT binary patch literal 1259 zcmZQ@_Y83kiVO&0*jXMoqh_t#lHIQIE1zvpDb+XB+&BN|Dp7?E0UnDUnam1#@MF%V znc3eC3MfTLT-UqAZeSF=TjG=Ul}oDKVk}n~+&B-hdv8;3GjE;uNv?BcG22D1CXTBn z%~AqV917|_v;F(F{(Mn%&2~oO^um>%qO!jxNjQHfud_HaVZR*vPR8EWtn>elpYBUB z{u^r&XAxv|vAdZq_nY(2+WHk5?zNgbgKQ@MGrU<4%Xar(!JQA2uLlT9s=mIwZr{vK z6Ae~QtM_v2OW8UDC%w^IFLdpnMC06StI%B=?N6{AWshohILUKl;ZM%G9~ult%MEHD zUh{fid-8M0BE!Q~;9?334~{@BBK>0-tI{3U1ZXjL$KlM@Aik!F?26(5nCT=(~1ipwnNsQ#(A-g;{-|C#^xp3fDT zr>m`8C;IlG=IiNml4JFIt+hN3rgi0NN>yEWkiu<|@T?sBEhQ2KC^owv#y?<_xM(0*VXIWkDUpd){<|3`eM!L*Gdi_ z7yI|kTywE{qTHEpEIYsXz4Kic%l^u=3l;OEZHfyMs{ca)*C_9l6jM# zA3xL^%@}p$4Z~HnnF?%cZsp2}omlX7`>fi3IR)tk(^gsJ+y7Wp|CA+t+NY-hg-2yt zOanFwU+P}*IXg|F%k=TuKA+Y9x@P>o`%mcjQ3Z{-bcH{8txGdaw0XbX$UgQ<+HmWn zpMMN5c-lKCYWL*ya-?}mO#TCOvi}q{j zoH^|JCBt-*+Dy4buS~i7C8{L~m)hrD-f6C9t9>YO&eZAulFqE1`f%R2ua=YQJmyajJn=*G z-{A(c|9i_Kj~6xE>sHrizOI!&^T*ljdu~3;SJgvr^WG6M?0jeO_PE=eaF?GG{PLO2 z_iipYFpcRakF|QlgPq4`i+t&ylb8G1L5R2bKz^C@#azwVOBmN)T@|ciW4LTS*S`9c zrt?w3uEC%G?0=@TurX_A^}4?i=PLg6{rbJuxFj}*-PGdik8hR}(%5_NN3EZ=uX0K{ z^R>F|cRF*@C46ok>Yo4g(&Fu_cYP=p`})l=Ug^;$-s0BH>;7yniAZst8eGBA^e|)3 z8DSRYjNQxXwkA->|y=6^+e(G=t)O@Hh;KwNAFbP zpN|rrcN0Z2wyMPj>O}sTu|~d$?e_Pfoy=HKF`)qYJ*#{0Mb zoAJQ~PR@g1w kTlM*}4s&i_Nh$aFjE+~K7tPvF8_1=WwmW#`KZ&mb0A(k6W&i*H literal 1052 zcmZQ@_Y83kiVO&0IQ#MFBY|nNCxu7bo-2!uy))fEXxf=5>j?}3$6vkk(SovsuqpyQ)c@L$u=v8qmId2ztq%SM_~A3AQl{W{f6 zmnlRjH}d}zvG;q=Bs{wNSzqZ6&+83;6Q+C$ypwR`e!u3|e`j{PIOQbI{&=^_ZRU^f zW(pd`%hEL}uPJTb;j8jNJ?4Ay5B9C@g&WEq&#TptS#`@}C7ucgm&~p9I2@6ADnBy$fpyY#Z6+C2OU2eTZx>B3|1KrBmhs&| z?padXwGWx}iKYdY6i;aWlEHtbAjIZ@VxO@=_#YX;Nr7yqzDG*`I2uz``oK(j$FX?^ z+pn-qzqX@?=dMF;_&uAAd@N5bWY=E5cfe6I{0!rTy0`;Lip3l4_};!Ue7Iz8wB&QsG)eS0HY zoON%?v&*Lz+Qv`LIOt@g!~3&slHrEiAN|B6D*rRchfd;~%(VD)(L#pnTlT?VIz?esAQm{;hd&iHu5gZ1)nrPtTTd z2`)H3%PeyKJ^RSEP5)QyG+r&fA+^YVm8IC<4^wxae{)2%XOjEh-E{`yTq{0oopyCu zW0(5Tko;Yzz2D5fw(ZQ({Uolg(TYU8H%sNCNtx4q0@Z%f$}Gp~}hx*2j##kSt{Vuzk@n7&TIw{x;)>n4up9#2*0UsG7ln&RcOE_lwtO@i9-`c6-` zq)T4+;=J8+UaQ*IE+YITyMx#+4xP$FR~Lr+u8aK_R`gs$>+BV+|4)l1wtwIZdB`tk zaYy>eSI;b0scBJxi+|4Y%E+;@S)yB|@#Xve?-qCbt(Y_Q7u|k5zmmnH!S3&*KgFki ztn}h7?qEH1Nz}A>>VIQ_a8}(Qk%`yuPHc?OsxYu`lbKs8`{Jzluk8$1Hhm8GIJ3&; z>88FOcQ@6&b9`mjxl4xR-aI`aTCZW6N636ZtE1-0E$Pe9v^5 zt5MhE^OR?b`4%6Fp?5mCb Y#_geDjq}YOOi-v3i8;OCW5@A*0Bem1Q~&?~ diff --git a/secrets/sops/secrets.yaml b/secrets/sops/secrets.yaml index d1e7e9b..a2fd5b4 100644 --- a/secrets/sops/secrets.yaml +++ b/secrets/sops/secrets.yaml @@ -4,10 +4,6 @@ github: runner: ENC[AES256_GCM,data:i+0mDBPrRxo6k7lrG5JfvPYPBhDuw69ubCY2M0MMZczu97b3QdnKZw==,iv:zOuGzA6M32u00MC+Cc1ypHBbQIWytUQEyJTUuHO0gSs=,tag:n08pp173HqF9eqmIxjzMAg==,type:str] runner-oasys: ENC[AES256_GCM,data:s6DicaREOQ6hC9MIcw/PY6lX0PAcnoDzrKZDNJkDlNp9sYOskwDyLkpWbuakbl+kC9x9CjeP4608o7Gey/HTB74Veza689W4FMn+ySFD038ilU3AjzZLJffQl9/J,iv:j6RJ4PP6y/jsid0mvcn7re6stx8+QV5ci1s3kuAiVQI=,tag:6WUG9DKf5Sj+orJZSfC4Iw==,type:str] nixpkgs-update: ENC[AES256_GCM,data:aTQC7w59Z0u4po3C7oWbIiWgahK9tOfQNwoQRKYgGSCMsCNq07E+mA==,iv:8Dyu1lJACYa6HnVcppkGr/1tcV8vMu7qQrdcXchhgkk=,tag:U8z64cxoPkSeV5gxDkC/KA==,type:str] -postgresql: - vaultwarden: ENC[AES256_GCM,data:hZJcZ8w2YT4SH4aLxnffoeuEyNnOISiGfidEHM4e/cFbbpvxna2R96h0aqg=,iv:YKvXB8IxDUeBeRQZNQrGfahLLswInzi5ZOZrMvpNq/I=,tag:Ak/NSwXjtuwthCIl+jyN8w==,type:str] - forgejo: ENC[AES256_GCM,data:f4NHIfVFnzJOoKKySrBKAj/2aWq0lz4zaWiyaUaR0ETOC2LcpMPZ9cgfDTs=,iv:Y1NaVqdHUewhpMc08ZpUBujx3iw0r2z8l0wXfaJ4E6Q=,tag:aS5H6YIDjovSmJUk6mVOWw==,type:str] - grafana: ENC[AES256_GCM,data:NyE0vaUi6ECgX0gMpx8qa5D4kRc6qpsiuVjPkh78q3+HuOs5AEPnpwf22kw=,iv:qp3Xx9NgxTBTkMJKHhnYmjckVzHjAuqgK3gCo7t8A60=,tag:cfzVUg89uO1urOKYDYQRhw==,type:str] tailscale: actions: ENC[AES256_GCM,data:2eIgnhfYt8ZSrEPZ2d7ynHU5WhB3DUnBSPjMx3tQaL6sxuOmHUN5NuLdL7aot/RWn/A9SMcDTJdsDAwo,iv:E04WX6G8M5n8x36YgyMT2lDzsPqluLSd1p4Q6UHbm4M=,tag:TJdJ+ioeitGf+MyapXqyPg==,type:str] tsdproxy: ENC[AES256_GCM,data:FZNL/UATBqS/Wp2LyA+bvzivSk8yunywAyjUKxYrAWiMzxhooJDlkcY/MZnO4TlG2JIfX8i1BKyjGbpWyj8=,iv:ujv/yxbVkeeJkK9JoYnySvsbMIsbU1FN/TfqMz4fTmk=,tag:i7zE1J6Fh8MCB2LDbho0YQ==,type:str] @@ -52,7 +48,7 @@ sops: ZUZQcjZod1orQ1VKaEJ0QjJIKzlOQzAKvhXUFxOP9UYoLfurNCuVB/1joob2oAB9 /wC3fMo0STB1oUTNr5r6liMfjzm8ZdbHolK1TzMkrePz6zznFkJL1w== -----END AGE ENCRYPTED FILE----- - lastmodified: "2025-05-05T01:34:07Z" - mac: ENC[AES256_GCM,data:NkZvdZco75WjtssAOzxjARduFW57MZDZmgR0U9+76aR6PDornheX0y6a/LQ0z7++l0yy1MO68QpvIolImdDvkGNyW/bvBQCQGMF94RXjtUKEcB9QbPYjb0csBTcuKBvJglmkQU+Jqk/qphiUnyBYiORepb9F9DC9VfuNQ5VGjQo=,iv:JMaOl4YYuyKdh6w6pM/WYZK3f/6x8RbwAskWlPDhn7U=,tag:qRFxMY50X981LcUD5QP+pA==,type:str] + lastmodified: "2025-05-05T03:20:09Z" + mac: ENC[AES256_GCM,data:oYq4IHWP/pysaQWdzTrVgppdQOlZ+aPYMaivYUfxPsP2UaMgn3CLfnvOWM/68xU3HzdkjFn0A51Q/25X42efs3jHTY72u7kdL3GfePsBdxNOAb1GMtd/QrmTDMizlfSBgb5IZhb/eQB2joMg8W/FYoWna/TgmwE+aXFQdBO5JSE=,iv:6df9ADqB2iQPymx29ptqe9aA8ncM1051NqdyfWonXKY=,tag:er4uJ36x1DlCfmtBgLp1qw==,type:str] unencrypted_suffix: _unencrypted version: 3.10.2 diff --git a/system/default.nix b/system/default.nix index 3483442..063dc29 100644 --- a/system/default.nix +++ b/system/default.nix @@ -98,6 +98,11 @@ in { host = "chibi"; port = 5201; }; + + vaultwarden = { + host = "shiori"; + port = 5300; + }; }; unbound.dnsHost = "chibi"; diff --git a/system/hosts/shiori/default.nix b/system/hosts/shiori/default.nix index db762fe..5eb870c 100644 --- a/system/hosts/shiori/default.nix +++ b/system/hosts/shiori/default.nix @@ -17,6 +17,8 @@ httpd.enable = true; + vaultwarden.enable = true; + samba.mounts = { "shared" = "arisu"; }; diff --git a/system/secrets.nix b/system/secrets.nix index e68a75b..1362092 100644 --- a/system/secrets.nix +++ b/system/secrets.nix @@ -18,10 +18,6 @@ in { secrets = { "master-password" = {owner = c4patino.name;}; - "postgresql/forgejo" = {owner = c4patino.name;}; - "postgresql/grafana" = {owner = c4patino.name;}; - "postgresql/vaultwarden" = {owner = c4patino.name;}; - "github/auth" = {owner = c4patino.name;}; "github/runner" = {owner = c4patino.name;}; "github/runner-oasys" = {owner = c4patino.name;}; diff --git a/system/services/default.nix b/system/services/default.nix index 6a58d12..74ba524 100644 --- a/system/services/default.nix +++ b/system/services/default.nix @@ -9,5 +9,6 @@ ./pm2.nix ./slurm.nix ./uptime-kuma.nix + ./vaultwarden.nix ]; } diff --git a/system/services/storage/postgresql.nix b/system/services/storage/postgresql.nix index a4053b4..51a4b45 100644 --- a/system/services/storage/postgresql.nix +++ b/system/services/storage/postgresql.nix @@ -21,7 +21,12 @@ in { services = { postgresql = { enable = true; - settings.port = port; + enableTCPIP = true; + + settings = { + port = port; + }; + authentication = let permissionEntries = cfg.databases diff --git a/system/services/vaultwarden.nix b/system/services/vaultwarden.nix new file mode 100644 index 0000000..40e8bdc --- /dev/null +++ b/system/services/vaultwarden.nix @@ -0,0 +1,53 @@ +{ + pkgs, + lib, + config, + secrets, + ... +}: let + inherit (lib) mkIf mkEnableOption filterAttrs head; + cfg = config.vaultwarden; + pgCfg = config.postgresql; + + port = 5300; + + resolveHostIP = node: + if builtins.hasAttr node config.devices + then config.devices.${node}.IP + else builtins.throw "Host '${node}' does not exist in the devices configuration."; +in { + options.vaultwarden.enable = mkEnableOption "vaultwarden"; + + config = mkIf cfg.enable { + services.vaultwarden = { + enable = true; + package = pkgs.vaultwarden-postgresql; + dbBackend = "postgresql"; + config = { + DOMAIN = "http://vaultwarden.yumeami.sh"; + + SIGNUPS_ALLOWED = false; + SIGNUPS_VERIFY = false; + + DATABASE_URL = let + ip = + pgCfg.databases + |> filterAttrs (host: dbs: lib.elem "vaultwarden" dbs) + |> lib.attrNames + |> head + |> resolveHostIP; + in ''postgresql://vaultwarden:${secrets.postgresql.vaultwarden}@${ip}:5600/vaultwarden''; + + LOG_LEVEL = "Info"; + + ROCKET_ADDRESS = "0.0.0.0"; + ROCKET_PORT = port; + ROCKET_LOG = "critical"; + + EXPERIMENTAL_CLIENT_FEATURE_FLAGS = "autofill-v2,extension-refresh,ssh-key-vault-item,ssh-agent"; + }; + }; + + networking.firewall.allowedTCPPorts = [port]; + }; +}