nixfiles/config/services/vaultwarden.nix

44 lines
1.4 KiB
Nix

{ config, ... }: {
sops.secrets."services/vaultwarden/environmentFile" = {
sopsFile = ../../secrets/services/vaultwarden.yaml;
owner = "vaultwarden";
};
services.vaultwarden = {
enable = true;
environmentFile = config.sops.secrets."services/vaultwarden/environmentFile".path;
config = {
DATA_FOLDER = "/var/lib/vaultwarden";
DOMAIN = "staging.vault.kyouma.net";
DATABASE_MAX_CONNS = 15;
WEB_VAULT_ENABLED = true;
WEBSOCKET_ENABLED = true;
WEBSOCKET_ADDRESS = "::1";
WEBSOCKET_PORT = 3012;
SENDS_ALLOWED = true;
ORG_ATTACHMENT_LIMIT = 1048576;
USER_ATTACHMENT_LIMIT = 524288;
USER_SEND_LIMIT = 1048576;
INCOMPLETE_2FA_TIME_LIMIT = 5;
SIGNUPS_ALLOWED = true;
SIGNUPS_VERIFY = true;
INVITATION_ORG_NAME = "vault.kyouma.net";
PASSWORD_ITERATIONS = 1200000;
ICON_DOWNLOAD_TIMEOUT = 30;
SMTP_HOST = "mail.kyouma.net";
SMTP_FROM = "vault@kyouma.net";
SMTP_FROM_NAME = "vault.kyouma.net";
SMTP_USERNAME = "vault@kyouma.net";
SMTP_SECURITY = "starttls";
SMTP_PORT = 587;
ROCKET_ADDRESS = "unix:/run/vaultwarden/rocket.socket";
ROCKET_PORT = "";
};
};
kyouma.nginx.virtualHosts."staging.vault.kyouma.net" = {
locations."/" = {
proxyPass = "http://unix:/run/vaultwarden/rocket.socket";
proxyWebsockets = true;
};
};
security.acme.certs."staging.vault.kyouma.net" = {};
}