nixos-config/modules/services/server/vaultwarden.nix

#
# System notifications
#

{ config, lib, pkgs, ... }:

{
  services.vaultwarden = {
    enable = true;
    dbBackend = "postgresql";
    environmentFile = config.age.secrets."services/vaultwarden/environment".path;
    config = {
      DOMAIN = "https://vault.kabtop.de";
      SIGNUPS_ALLOWED = false;
      ROCKET_ADDRESS = "127.0.0.1";
      ROCKET_PORT = 8222;

      ROCKET_LOG = "critical";
    };
  };

  services.nginx = {
    enable = true;
    recommendedTlsSettings = true;
    recommendedOptimisation = true;
    recommendedGzipSettings = true;
    recommendedProxySettings = true;
    virtualHosts = {
      "vault.kabtop.de" = {
        enableACME = true;
        forceSSL = true;
        locations."/".proxyPass = "http://127.0.0.1:${toString config.services.vaultwarden.config.ROCKET_PORT}";
      };
    };
  };

  systemd.services = {
      vaultwarden = {
          requires = [ "postgresql.service" ];
      };
  };
  age.secrets."services/vaultwarden/environment" = {
      file = ../../../secrets/services/vaultwarden/environment.age;
      owner = "vaultwarden";
  };
}