@cryptotaxi247 / infra-1
Code Commits Issues Pulls Sessions CI/CD
main
main
nix 97 lines 2.48 KB
Raw
1 { config, ... }:
2 {
3 imports = [
4 ./backup.nix
5 ./postfix.nix
6 ];
7
8 services.vaultwarden = {
9 enable = true;
10 backupDir = "/var/backup/vaultwarden/";
11 environmentFile = "/var/lib/bitwarden_rs/vaultwarden.env";
12 config = {
13 DOMAIN = "https://vault.nixos.org";
14 SIGNUPS_ALLOWED = false;
15 SHOW_PASSWORD_HINT = false;
16 ROCKET_ADDRESS = "127.0.0.1";
17 ROCKET_PORT = 8222;
18 ROCKET_LOG = "critical";
19 SMTP_HOST = "localhost";
20 SMTP_PORT = 25;
21 SMTP_SSL = false;
22 SMTP_FROM = "vaultwarden@caliban.nixos.org";
23 SMTP_FROM_NAME = "NixOS Vaultwarden";
24 ORG_EVENTS_ENABLED = true;
25 };
26 };
27
28 services.nginx = {
29 enable = true;
30 recommendedGzipSettings = true;
31 recommendedOptimisation = true;
32 recommendedProxySettings = true;
33 recommendedTlsSettings = true;
34 virtualHosts."vault.nixos.org" = {
35 forceSSL = true;
36 enableACME = true;
37 locations."/" = {
38 proxyPass = "http://127.0.0.1:${toString config.services.vaultwarden.config.ROCKET_PORT}";
39 };
40 };
41 };
42
43 sops.secrets = {
44 vaultwarden-env = {
45 sopsFile = ../secrets/vaultwarden-env.caliban;
46 format = "binary";
47 path = "/var/lib/bitwarden_rs/vaultwarden.env";
48 };
49
50 };
51
52 services.backup.includes = [ config.services.vaultwarden.backupDir ];
53
54 services.fail2ban = {
55 enable = true;
56 jails = {
57 vaultwarden-web = {
58 filter = {
59 INCLUDES.before = "common.conf";
60 Definition = {
61 failregex = "^.*Username or password is incorrect. Try again. IP: <ADDR>. Username:.*$";
62 ignoreregex = "";
63 };
64 };
65 settings = {
66 backend = "systemd";
67 port = "80,443";
68 filter = "vaultwarden-web[journalmatch='_SYSTEMD_UNIT=vaultwarden.service']";
69 banaction = "%(banaction_allports)s";
70 maxretry = 3;
71 bantime = 14400;
72 findtime = 14400;
73 };
74 };
75 vaultwarden-admin = {
76 filter = {
77 INCLUDES.before = "common.conf";
78 Definition = {
79 failregex = "^.*Invalid admin token. IP: <ADDR>.*$";
80 ignoreregex = "";
81 };
82 };
83 settings = {
84 backend = "systemd";
85 port = "80,443";
86 filter = "vaultwarden-admin[journalmatch='_SYSTEMD_UNIT=vaultwarden.service']";
87 banaction = "%(banaction_allports)s";
88 maxretry = 3;
89 bantime = 14400;
90 findtime = 14400;
91 };
92 };
93 };
94
95 };
96
97 }