non-critical-infra: vaultwarden init
Julien Malka committed
Oct 16, 2023 at 20:29 UTC
ce9d9ac8ca5b4e0cf45b1d9178833b4c8e93c73b
3 files changed
+137
-1
non-critical-infra/hosts/caliban.nixos.org/default.nix
+5
-1
@@ -8,6 +8,7 @@
8
inputs.srvos.nixosModules.hardware-hetzner-online-amd
9
../../modules/first-time-contribution-tagger.nix
10
../../modules/backup.nix
11
+ ../../modules/vaultwarden.nix
12
];
13
14
# Bootloader.
@@ -36,7 +37,10 @@
37
38
services.openssh.enable = true;
39
39
- networking.firewall.allowedTCPPorts = [ ];
40
+ security.acme.acceptTerms = true;
41
+ security.acme.defaults.email = "webmaster@nixos.org";
42
+
43
+ networking.firewall.allowedTCPPorts = [ 80 443 ];
44
networking.firewall.allowedUDPPorts = [ ];
45
46
systemd.network.networks."10-uplink".networkConfig.Address = "2a01:4f9:5a:186c::2";
non-critical-infra/modules/vaultwarden.nix
new
+100
@@ -0,0 +1,100 @@
1
+{ config, ... }:
2
+{
3
+ imports = [
4
+ ./backup.nix
5
+ ];
6
+
7
+ services.vaultwarden = {
8
+ enable = true;
9
+ backupDir = "/var/lib/bitwarden_rs/backups/";
10
+ environmentFile = "/var/lib/bitwarden_rs/vaultwarden.env";
11
+ config = {
12
+ DOMAIN = "https://vault.nixos.org";
13
+ SIGNUPS_ALLOWED = false;
14
+ SHOW_PASSWORD_HINT = false;
15
+ ROCKET_ADDRESS = "127.0.0.1";
16
+ ROCKET_PORT = 8222;
17
+ ROCKET_LOG = "critical";
18
+ SMTP_HOST = "mail.gandi.net";
19
+ SMTP_PORT = 587;
20
+ SMTP_SSL = true;
21
+ SMTP_FROM = "vaultwarden@nixos.org";
22
+ SMTP_FROM_NAME = "NixOS Vaultwarden";
23
+ };
24
+ };
25
+
26
+ services.nginx = {
27
+ enable = true;
28
+ recommendedGzipSettings = true;
29
+ recommendedOptimisation = true;
30
+ recommendedProxySettings = true;
31
+ recommendedTlsSettings = true;
32
+ virtualHosts."vault.nixos.org" = {
33
+ forceSSL = true;
34
+ enableACME = true;
35
+ locations."/" = {
36
+ proxyPass = "http://127.0.0.1:${toString config.services.vaultwarden.config.ROCKET_PORT}";
37
+ };
38
+ };
39
+ };
40
+
41
+ sops.secrets = {
42
+ vaultwarden-env = {
43
+ sopsFile = ../secrets/vaultwarden-env.caliban;
44
+ format = "binary";
45
+ path = "/var/lib/bitwarden_rs/vaultwarden.env";
46
+ };
47
+
48
+ };
49
+
50
+ services.backup.includes = [ config.services.vaultwarden.backupDir ];
51
+
52
+ services.fail2ban = {
53
+ enable = true;
54
+ jails = {
55
+ vaultwarden-web = {
56
+ filter = {
57
+ INCLUDES.before = "common.conf";
58
+ Definition = {
59
+ failregex = "^.*Username or password is incorrect\. Try again\. IP: <ADDR>\. Username:.*$";
60
+ ignoreregex = "";
61
+ };
62
+ };
63
+ settings = {
64
+ backend = "systemd";
65
+ port = "80,443";
66
+ filter = "vaultwarden_web[journalmatch='_SYSTEMD_UNIT=vaultwarden.service']";
67
+ banaction = "%(banaction_allports)s";
68
+ maxretry = 3;
69
+ bantime = 14400;
70
+ findtime = 14400;
71
+ };
72
+ };
73
+ vaultwarden-admin = {
74
+ filter = {
75
+ INCLUDES.before = "common.conf";
76
+ Definition = {
77
+ failregex = "^.*Invalid admin token\. IP: <ADDR>.*$";
78
+ ignoreregex = "";
79
+ };
80
+ };
81
+ settings = {
82
+ backend = "systemd";
83
+ port = "80,443";
84
+ filter = "vaultwarden-admin[journalmatch='_SYSTEMD_UNIT=vaultwarden.service']";
85
+ banaction = "%(banaction_allports)s";
86
+ maxretry = 3;
87
+ bantime = 14400;
88
+ findtime = 14400;
89
+ };
90
+ };
91
+ };
92
+
93
+
94
+ };
95
+}
96
+
97
+
98
+
99
+
100
+
non-critical-infra/secrets/vaultwarden-env.caliban
new
+32
@@ -0,0 +1,32 @@
1
+{
2
+ "data": "ENC[AES256_GCM,data:rMUrzw6AwN5QNUPeujhR5srzXXAulElsZpRIxECedCTJ72ovf+naFfkfrApD8Jd6LdtAYvclYs/KBBEi9XlqWJuianie+nVkVy341Z8fWiGaTb07m9UjzxF62lXpBbBu2xv+eS9/2kY83KZSgRYHxiJ/Z4of2ixc1L7Np56UwZD1+uxP1Ecu7WPQGwJRxKLaKd/JHJ7z+B9twA/N0Otn67ilRMss0rxYqA+yHH+I8r/6QF4Ulq/ULhAoXRKs3jpKIOLYGkRe5T4m0B/U5tR+P42XTdPtdFMR67Tk73Hb,iv:+LkKeny2z5QU+oztPnwJkSkHVUvYIzzMecQX6Wc0aYE=,tag:L3FKtuWWj32rMagR+fw8aA==,type:str]",
3
+ "sops": {
4
+ "kms": null,
5
+ "gcp_kms": null,
6
+ "azure_kv": null,
7
+ "hc_vault": null,
8
+ "age": [
9
+ {
10
+ "recipient": "age1j3mkgedmeru63vwww6m44zfw09tg8yw6xdzstaq7ejfkvgcau40qwakm8x",
11
+ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1K1BOVU40RHQ5TjVTOEs4\nRmIvZW9ZWnJmN1BrUDZxQmpzMUpabzV0Zkd3CktFcFcxdkJOcWRPL2FBKzRmb1ph\nbHJwL1hHbFpTNXFnMUplc2ZPcUd5RHcKLS0tIEJyUUhSVlBPZGlUcFZPUW1RS2Qx\nRnEzckR1N1JZOWN0bUVNWkFQajhVUEkKI8jb+DCqnxr+6AfzXBte4xFOdscOyBz0\n1a5fS0FQ8+Can/MGGrpL4q/xPbhzKy1lUom2/kehYWHmJ8sHwJAGcA==\n-----END AGE ENCRYPTED FILE-----\n"
12
+ },
13
+ {
14
+ "recipient": "age1qlwzeg37fwwn2l6fm3quvkn787nn0m89xrjtrhgf9uedtfv2kqlqnec976",
15
+ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHaDZaVi8zZ2I1N0FpblJr\nV1B4R2pEbHlKWml5eE5Va2kzRUV3TVBnMVIwCmJQbThKc05xTkR0UEM1Qjkvd05O\nQTh4WmFRUXJMS0M4TEhMTDNUUkdNOVkKLS0tIE9FaCt1eXNVZExJTTQ2STY1aVhF\nOTZ2R2hsdWwrUUpadzlqM055UHozTVEKntJdbft7gNl6W9OrJOpHfe1By7CFvzc5\nyWvaYknU3j7nhvxarF6f9rt8upPUueGxyDW8HZXrR305dYNLafH48g==\n-----END AGE ENCRYPTED FILE-----\n"
16
+ },
17
+ {
18
+ "recipient": "age1jrh8yyq3swjru09s75s4mspu0mphh7h6z54z946raa9wx3pcdegq0x8t4h",
19
+ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQMm51ZnFFSE42Q3pyQ1J4\nNEt1S3NRczZTU1AwSDJUNFZxaGV3d3p2VlQ4Ci8wZ2R0cWFnK0NwTUJwem9YQ2ZC\nYy9lSDRTNGRPcVpwbHhBemtGV0ttSGMKLS0tIEk0YTBUS0UvazdxbFhxd0FtdmIw\nRFU4ZWFJZGd3dXArMHlVRzd6aXpzTzgKzQjjkmUsVJkeLAgZQ4/1OD2bgPTt9RRx\nwnTsJ7+0KI5NYMmxgrvcw5Wcrj6aVsIJGZUB/pDK+xfjmkZXI1RgYw==\n-----END AGE ENCRYPTED FILE-----\n"
20
+ },
21
+ {
22
+ "recipient": "age1sv307kkrxwgjah8pjpap5kzl4j2r6fqr3vg234n7m32chlchs9lsey7nlq",
23
+ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFUTBvTWY4VFFsSkdsWGlD\nSjBLRGVoWXBMbDRRRWVuYnVpaW05ZDRvR25RCjBTNmFkM3ptZTQrTWcvczJQWUlT\nbFMrRlZjSUlFVDlsWVRiZzZEK203QlkKLS0tIHE5Si9mYkpSRFNQa0J1ZXhvZ2dk\nSHpNYldXMjNHMDMwV3JqdUQ1Z3VZWTgKK8pb/aVyhvX5xPlcz211NZX3/sxGO3ff\nL9uC++BcZntVyZiY7mDn1bqXFjdqKa4sLAbSqcZLOPaY5DA9skdpsg==\n-----END AGE ENCRYPTED FILE-----\n"
24
+ }
25
+ ],
26
+ "lastmodified": "2023-10-16T16:40:23Z",
27
+ "mac": "ENC[AES256_GCM,data:/Dt2+LpFW1HPwngXtDClE/eu+hbHroTJoZ6AG69/i5yiwtuU4obudvs4cdLRw6Wu3jQQrU4jx/sDip/hplAYtEYA/4tphU6rqt5EgZ0dNYdy9KOSKQ6M1nRRopzd2xX5xhdy6YekSUwpwWwADik9zBiFu3UhRlEIsSGJUDYt74M=,iv:G3BRfPu+bmy1cxtNra3pTQPaEfjUW104tpW8g2ruk4U=,tag:St0/jLz5MZTEifiE5In1ug==,type:str]",
28
+ "pgp": null,
29
+ "unencrypted_suffix": "_unencrypted",
30
+ "version": "3.7.3"
31
+ }
32
+}
\ No newline at end of file