tbarnouin/nixos-hypervisor
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add crowdsec vaultwarden config

Browse source
This commit is contained in:
Théo Barnouin 2025-06-05 14:34:30 +02:00
parent 5251de6062
commit dc84347b88
4 changed files with 43 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

30
services/vaultwarden/default.nix
View file

@ -9,20 +9,46 @@ in {
enable = lib.mkEnableOption "Enable minimal config";
};
config = lib.mkIf cfg.enable {
age.secrets.env-file = {
file = ./secrets/env-file.age;
age.secrets = {
vaultwarden-lapi-key = {
file = ../../secrets/vaultwarden-lapi-key.age;
owner = "crowdsec";
};
env-file = {
file = ./secrets/env-file.age;
};
};
services = {
crowdsec = {
hub.collections = [
"Dominic-Wagner/vaultwarden"
];
settings.lapi.credentialsFile = "${config.age.secrets.vaultwarden-lapi-key.path}";
localConfig = {
acquisitions = [
{
source = "journalctl";
journalctl_filter = ["_SYSTEMD_UNIT=vaultwarden.service"];
labels = {
type = "syslog";
};
}
];
};
};
vaultwarden = {
enable = true;
dbBackend = "postgresql";
environmentFile = config.age.secrets.env-file.path;
config = {
ROCKET_ADDRESS = "0.0.0.0";
ROCKET_PORT = "8000";
DOMAIN = "https://vault.le43.eu";
SIGNUPS_ALLOWED = false;
IP_HEADER = "X-Forwarded-For";
};
};
};
networking.firewall.allowedTCPPorts = [8000];
};
}