diff --git a/applications/bitwarden/vaultwarden.nix b/applications/bitwarden/vaultwarden.nix new file mode 100644 index 0000000..22808e9 --- /dev/null +++ b/applications/bitwarden/vaultwarden.nix @@ -0,0 +1,93 @@ +{ + config, + pkgs, + lib, + inputs, + ... +}: +with lib; let + cfg = config.services.skynet_vaultwarden; + + domain_sub = "pw"; + domain = "${domain_sub}.skynet.ie"; +in { + imports = [ + ../acme.nix + ../dns.nix + ../nginx.nix + ]; + + options.services.skynet_vaultwarden = { + enable = mkEnableOption "Skynet vaultwarden server"; + + host = { + ip = mkOption { + type = types.str; + }; + + name = mkOption { + type = types.str; + }; + }; + }; + + config = mkIf cfg.enable { + #backups = [ "/etc/silver_ul_ical/database.db" ]; + + # Website config + skynet_acme.domains = [ + domain + ]; + + skynet_dns.records = [ + { + record = domain_sub; + r_type = "CNAME"; + value = cfg.host.name; + } + ]; + + services.nginx.virtualHosts."${domain}" = { + forceSSL = true; + useACMEHost = "skynet"; + locations."/" = { + proxyPass = "http://127.0.0.1:${toString config.services.vaultwarden.config.ROCKET_PORT}"; + }; + }; + + # has ADMIN_TOKEN and SMTP_PASSWORD + age.secrets.bitwarden_details.file = ../../secrets/bitwarden/details.age; + + services.vaultwarden = { + enable = true; + + environmentFile = config.age.secrets.bitwarden_details.path; + config = { + DOMAIN = "https://${domain}"; + SENDS_ALLOWED = true; + SIGNUPS_ALLOWED = false; + + INVITATION_ORG_NAME = "Skyhold"; + + ORG_GROUPS_ENABLED = true; + + USE_SENDMAIL = false; + + SMTP_HOST = "mail.skynet.ie"; + SMTP_FROM = "vaultwarden@skynet.ie"; + SMTP_FROM_NAME = "Skynet Bitwarden server"; + SMTP_SECURITY = "starttls"; + SMTP_PORT = 587; + + SMTP_USERNAME = "vaultwarden@skynet.ie"; + SMTP_AUTH_MECHANISM = "Login"; + SMTP_EMBED_IMAGES = true; + + ROCKET_ADDRESS = "127.0.0.1"; + ROCKET_PORT = 8222; + + ROCKET_LOG = "critical"; + }; + }; + }; +} diff --git a/machines/kitt.nix b/machines/kitt.nix index da699d3..5891571 100644 --- a/machines/kitt.nix +++ b/machines/kitt.nix @@ -23,6 +23,8 @@ in { imports = [ ../applications/ldap/server.nix ../applications/discord.nix + ../applications/bitwarden/vaultwarden.nix + ../applications/bitwarden/bitwarden_sync.nix ]; deployment = { @@ -66,4 +68,13 @@ in { services.discord_bot = { enable = true; }; + + services.skynet_vaultwarden = { + enable = true; + + host = { + ip = ip_pub; + name = name; + }; + }; } diff --git a/secrets/bitwarden/details.age b/secrets/bitwarden/details.age new file mode 100644 index 0000000..3d5ac2a --- /dev/null +++ b/secrets/bitwarden/details.age @@ -0,0 +1,16 @@ +age-encryption.org/v1 +-> ssh-ed25519 V1pwNA d3Xy8iQxiSb8gV8NRqBAxBm0g5V1INUAeHJDFdAqe3o +Uaw/Q/BjZabCWBoKJmSICiUn8/OWXjj+/sx0BZKxWj8 +-> ssh-ed25519 4PzZog qxpYb+zz05nntFRA8k0ZwWSmpvOA8gnf8AaBuy5xyhQ +ssOtug0RBDkPbSEC4Acs/UNelfLmkLLH2pEm0geAuVE +-> ssh-ed25519 5Nd93w iXfwzbDeUuFqwXPztMdaBXnfXY7W8sQXmcxEtMqkPzM +t88pMxJ09RtrNEd1tn8N5iUh2mnaHwzb3dD6xlt8jRw +-> ssh-ed25519 q8eJgg 4NAejBkAf4tZEsq6YsWJiOTq3wBBkDHB3Z1CFG8LeSk +yIicVNLUkaHs9RzaEFFn0SVqR5QiKNJZShehiEfvTh4 +-> ssh-ed25519 IzAMqA orpGqetn3ND76DC2QejaGnAlPDlV43l7/GdJB47SFQA +U0Bm9/VgoY6/dwIdqZpOY5rQc5j/TBlKzRS8rndyxu4 +-> _-grease yOwV[T R\ b>SI aVM^#_X +VfqPBdd5CK3GXPcBxXzbq9ak7qYJrnrxU7O7pKmfavJJ55dsmXKvEI7NE2tgASsr +Gxc1ttbQ4310R2CN0IM7xvMRLQsg/MnA2WGiwO52OYkHJXZ/i9F8ro4sq8q5cJE +--- T8NUXH3YnnAIycabcEi8uFUfnDuvdgy3COrUoPPA+lQ +QýPE*NcY޳ Y튰nKBaz^fJyhW!u|dDq'}6^5wSk1%Nsmwi+|Dpϔqr!1ə ?H$(f͐gKn{a93tl܂GbrでbMY(`y&,'{= \ No newline at end of file diff --git a/secrets/email/details.age b/secrets/email/details.age index 677a153..3c73aa0 100644 --- a/secrets/email/details.age +++ b/secrets/email/details.age @@ -1,23 +1,23 @@ age-encryption.org/v1 --> ssh-ed25519 V1pwNA P02Xzq2IYlbZMvvBUjy6eM0FN1CfSyCinTJnQrZUUlg -QU9CrDYFL0KwDiH9T0zOzydeJBm4eS+Rp4m2ozA3FA0 --> ssh-ed25519 4PzZog 0dqzbH7AY96+GFtwrkrcxYKuO/c9eBPgdxMKa1qliw0 -y0Kx5IG3CCzFcXM5MuS3eLij/l7QFKaHlr3VQty+gsA --> ssh-ed25519 5Nd93w i9j9spcBf2ww6koxQu+802p8ua70VmQTtuLNC/v8MzY -wgYQc+JdSPd2cen/mQyL4NVn9fHtRsHX0E5lDW06yMs --> ssh-ed25519 q8eJgg L55YurMQv+czgj6uwgHS3L2vX2A5VYRcUEXsGcj0r38 -vLRAuYLEljcVqVXs6k0hrVQNkRIpvvpCUeMP4jWVItQ --> ssh-ed25519 IzAMqA Q1wP64lIZtvFPa0wAD+jQZtS7NwDr4rkthZEoVtuJjo -EnLKgtFFpzEKpLZMatZFNTt0rINciFUryYd0GMIUSp0 --> ssh-ed25519 uZzB3g EwOnsGci+aqHj7XR+sVCi2pNowFbTLtQimzFNHy7LTo -jtl2RhtNayPr44rrZ1ESgR6p1hDJg1h70flu/0rDCjg --> ssh-ed25519 Hb0ipQ Jmcvd8zOLb7qf2ZIY1HsBrMA3wETGJFUTicBb/Gf2n4 -RTiE+f1N+npbnh1M20x76MJ/uj/5SDTdWKj1uMWPThM --> ssh-ed25519 IzAMqA cSzsukksm2E0coLmIXmd6DsEs/gHmIeGfcH/unNd1B4 -6ThlGLwm5iFG/UXoNMtAup909MVxz5JTpK45HJDeYFk --> d7'/PSOq-grease BF, -ka0OOXHqf7TrhcdP9NFMQVGlF2x+fnC5PRZba5o ---- s5GXDMgktkfdge6Ndk1J8ooCdXVsryH9XzD2+TF6wC8 -`2S -%͋cA2 w L(q\0})D#k)Y\&X"į506|4)._vD6Nҽ*+R)59 -E} ~gC1 ea \ No newline at end of file +-> ssh-ed25519 V1pwNA jq+XbDiOKLZYMvnmsSod+uedgov0IG0owyKLnh8UWSE +Qvoh1P8BCj677JtljcNsz+wlimAsOc6VhUMJhV1GqiU +-> ssh-ed25519 4PzZog QW53/Ugxrrxc409WcGAIvM1/Y4Vmx3ApggipX/eIEjw +IAYk1jPQmim0+TItOXAskS3PVgCnZDtYdIBKlvcLxwA +-> ssh-ed25519 5Nd93w sCuEYWuaUPIMRjZXmggeeWCgkIaJT7D5bAXb2ixWq2Q +1o9D3Uz/mNnh4ys0I78j25MiKlHqhGdaP+D8HvtpOWY +-> ssh-ed25519 q8eJgg 6WC13FFyND94sHo7cbG+3uZUNsmy42DmpUOVkCmVbHw +RJJ+3aUtwP1M4bDkiHKr0uz+HwRwH0bAn+GPEs4utGQ +-> ssh-ed25519 IzAMqA 87Jsefduk7iRFF84+ZvPGdTpz/FzRYuzg9UkbPQxPW8 +xBUyjiOg9/zq28fXFo2/kHitPuz3HaZ+ckEwgWqYXH4 +-> ssh-ed25519 uZzB3g 2/G93JVSGG8Bq3TzXiC7VxGvLgt8VpfBDxNLnsQJnzQ +eqvUUuCxDnj1YJt31bOXEZtCk6W8Fb073LUp6JoCLSs +-> ssh-ed25519 Hb0ipQ VrLe6mWpNh3VasQNuZoYVSG+UoExVvp9plKEuRi6+DQ +xem0syYeUihXShPuhN4Y0caleqYD3Guw89phtQ+IzHw +-> ssh-ed25519 IzAMqA Ki9fF+v0YtXbnZFOX9Qyp2RF8NkvtgVM2vWxvc7TiDI +parIXPuSLa9NKLw3tUJFWK3FsGfD85h+DL28y5sNgrk +-> c{-grease -ufY Ew| +tdST+ze++xYVJLumh6+FoeoLRYS2WKdR/HSY8UphDPJx1OW+2ZSJNyG5XjTX582r +zSM85sEgYsJe0arZqPDHwnjssUCkAuiLMZM8atLM +--- PICAIqdJW/DCPw9lvrRLsdMJLUFsE48EQxd03DboxqI +Hr !{'!yo$0:d6ituRf; ʹ݈?Ma6l; +P@pXkir& |2S#څ6A@~T*R/ \ No newline at end of file diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 57ff7c6..cc13d63 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -140,4 +140,5 @@ in { # for bitwarden connector "bitwarden/api.age".publicKeys = users ++ bitwarden; + "bitwarden/details.age".publicKeys = users ++ bitwarden; }