services: move vault to local

modules/services/nas/default.nix

@@ -12,6 +12,8 @@
 
 [
   ./nfs.nix
+  ./nginx.nix
+  ./vaultwarden.nix
 ]
 
 # picom, polybar and sxhkd are pulled from desktop module

modules/services/nas/nginx.nix

@@ -0,0 +1,42 @@
+#
+# System notifications
+#
+
+{ config, lib, pkgs, ... }:
+
+{
+  services.nginx = {
+    enable = true;
+    recommendedProxySettings = true;
+    recommendedTlsSettings = true;
+    recommendedGzipSettings = true;
+    recommendedOptimisation = true;
+    virtualHosts = {
+      "home.opel-online.de" = {
+        enableACME = true;
+        forceSSL = true;
+        default = true;
+        locations."/".return = "503";
+      };
+    };
+  };
+    
+
+  security.acme = {
+    acceptTerms = true;
+    defaults = {
+      email = "webmaster@opel-online.de";
+      server = "https://acme-staging-v02.api.letsencrypt.org/directory";
+      dnsResolver = "9.9.9.9:53";
+    };
+    certs = {
+      "home.opel-online.de" = {
+        domain = "*.home.opel-online.de";
+        dnsProvider = "netcup";
+        environmentFile = config.age.secrets."services/acme/opel-online".path;
+        webroot = null;
+      };
+    };
+  };
+
+}

modules/services/nas/vaultwarden.nix

@@ -0,0 +1,38 @@
+#
+# System notifications
+#
+
+{ config, lib, pkgs, ... }:
+
+{
+  services.vaultwarden = {
+    enable = true;
+    dbBackend = "sqlite";
+    backupDir = "/var/backup/vaultwarden";
+    environmentFile = config.age.secrets."services/vaultwarden/environment".path;
+    config = {
+      DOMAIN = "https://vault.home.opel-online.de";
+      SIGNUPS_ALLOWED = false;
+      ROCKET_ADDRESS = "127.0.0.1";
+      ROCKET_PORT = 8222;
+
+      ROCKET_LOG = "critical";
+    };
+  };
+
+  services.nginx = {
+    virtualHosts = {
+      "vault.home.opel-online.de" = {
+        useACMEHost = "home.opel-online.de";
+        forceSSL = true;
+        locations."/".proxyPass = "http://127.0.0.1:${toString config.services.vaultwarden.config.ROCKET_PORT}";
+      };
+    };
+  };
+
+  age.secrets."services/vaultwarden/environment" = {
+      file = ../../../secrets/services/vaultwarden/environment.age;
+      owner = "vaultwarden";
+  };
+
+}