mirror of
https://github.com/gensokyo-zone/infrastructure.git
synced 2026-02-09 12:29:19 -08:00
2a5ec2e0b4
Using ./home.nix and ./nixos.nix as entrypoints for hosts. Using hardware profiles. Using new entrypoints (profiles/base/profiles.nix + profiles/base/home.nix). New modules (for DNS handling, for themeing, ...). Split up deploy-tf.nix into several modules. Renamed common profile to base profile.
42 lines
1.1 KiB
Nix
42 lines
1.1 KiB
Nix
{ config, pkgs, ... }:
|
|
|
|
{
|
|
services.postgresql = {
|
|
ensureDatabases = [ "bitwarden_rs" ];
|
|
ensureUsers = [{
|
|
name = "bitwarden_rs";
|
|
ensurePermissions = { "DATABASE bitwarden_rs" = "ALL PRIVILEGES"; };
|
|
}];
|
|
};
|
|
|
|
users.users.vaultwarden.name = "bitwarden_rs";
|
|
users.groups.vaultwarden.name = "bitwarden_rs";
|
|
|
|
services.vaultwarden = {
|
|
enable = true;
|
|
dbBackend = "postgresql";
|
|
config = {
|
|
rocketPort = 4000;
|
|
websocketEnabled = true;
|
|
signupsAllowed = false;
|
|
domain = "https://vault.${config.kw.dns.domain}";
|
|
databaseUrl = "postgresql://bitwarden_rs@/bitwarden_rs";
|
|
};
|
|
};
|
|
|
|
services.nginx.virtualHosts."vault.${config.kw.dns.domain}" = {
|
|
enableACME = true;
|
|
forceSSL = true;
|
|
locations = {
|
|
"/".proxyPass = "http://127.0.0.1:4000";
|
|
"/notifications/hub".proxyPass = "http://127.0.0.1:3012";
|
|
"/notifications/hub/negotiate".proxyPass = "http://127.0.0.1:80";
|
|
};
|
|
};
|
|
|
|
deploy.tf.dns.records.services_vaultwarden = {
|
|
tld = config.kw.dns.tld;
|
|
domain = "vault";
|
|
cname.target = "${config.networking.hostName}.${config.kw.dns.tld}";
|
|
};
|
|
}
|