From b665d7cffefae54963b5e95b3fd142ceb097f2e3 Mon Sep 17 00:00:00 2001 From: Nettika Date: Wed, 8 Oct 2025 21:45:43 -0700 Subject: [PATCH] Setup vaultwarden on astral --- hosts/astral/default.nix | 29 ++++++++++++++++-- hosts/astral/secrets/vaultwarden-env.age | Bin 0 -> 370 bytes hosts/default.nix | 19 ++++++------ hosts/marauder/secrets/restic-env.age | 9 +++--- hosts/marauder/secrets/restic-password.age | Bin 246 -> 246 bytes hosts/quasar/default.nix | 2 +- .../quasar/secrets/matrix-synapse-secrets.age | Bin 426 -> 536 bytes secrets.nix | 14 ++++++--- 8 files changed, 51 insertions(+), 22 deletions(-) create mode 100644 hosts/astral/secrets/vaultwarden-env.age diff --git a/hosts/astral/default.nix b/hosts/astral/default.nix index 421f5e0..4e019e7 100644 --- a/hosts/astral/default.nix +++ b/hosts/astral/default.nix @@ -1,9 +1,10 @@ -{ nixosModules, modulesPath, lib, pkgs, ... }: { +{ modulesPath, nixosModules, agenix, lib, pkgs, config, ... }: { imports = [ "${modulesPath}/virtualisation/amazon-image.nix" nixosModules.nano nixosModules.nettika nixosModules.promptmoji + agenix.nixosModules.default ]; boot.loader.grub.device = lib.mkForce "/dev/nvme0n1"; @@ -14,7 +15,10 @@ dates = "weekly"; options = "--delete-older-than 30d"; }; - settings.trusted-users = [ "@wheel" ]; + settings = { + trusted-users = [ "@wheel" ]; + experimental-features = [ "nix-command" "flakes" ]; + }; }; networking = { @@ -22,6 +26,8 @@ firewall.allowedTCPPorts = [ 80 443 ]; }; + age.secrets.vaultwarden-env.file = ./secrets/vaultwarden-env.age; + users.defaultUserShell = pkgs.fish; security.sudo.wheelNeedsPassword = false; @@ -33,9 +39,28 @@ respond "astral is online" header Strict-Transport-Security: "max-age=63072000; includeSubDomains" ''; + "vault.leaf.ninja".extraConfig = '' + reverse_proxy localhost:8222 + ''; }; }; + services.vaultwarden = { + enable = true; + config = { + domain = "https://vault.leaf.ninja"; + signupsAllowed = false; + rocketAddress = "0.0.0.0"; + rocketPort = 8222; + smtpHost = "smtp.migadu.com"; + smtpFrom = "vaultwarden@leaf.ninja"; + smtpPort = 587; + smtpSecurity = "starttls"; + smtpUsername = "vaultwarden@leaf.ninja"; + }; + environmentFile = config.age.secrets.vaultwarden-env.path; + }; + programs.fish.enable = true; documentation.man.generateCaches = false; diff --git a/hosts/astral/secrets/vaultwarden-env.age b/hosts/astral/secrets/vaultwarden-env.age new file mode 100644 index 0000000000000000000000000000000000000000..83accd1590e1f22e60cbfb11a1212f09d5aa6142 GIT binary patch literal 370 zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCSn(+=<|3RFmR_jfLG zODrmOEY1%NOG^z;kMu~jG;}R-HH`50k4)D#FDZ+N^eznzGvUfe^mNa2D-VhA^GVhZ z^Ybf-^esv+3Jgi9% zIM^lIEwP}?&pA2JG9}o;xxy>JsHEJ$*f-BN+=9zjKddA%AS$mk#I4fAEiX9V-6uTC zJ>M_DB)h`LJhwb2)g#ryJX60Y)s;(ES63m&ATOoFJ ssh-ed25519 f+PJrQ qccE2xAzfBZ3DCRQtQDgwS1UzjlZx44oUrYjcDfMfDk -I2l6xRJsdQLYB2cMo0Kfi6mVyhZsuSPFG574P8pl12Y ---- WoBlo7fqYRkiBYPoLpa3wHB8ZPCVy32a4aL5UswCHJc -LΚ[N<#] B}f%PxKۨkI ssh-ed25519 f+PJrQ VJshLBSbF93anR9fOJ3Kwhxh1AOdvsS0hoJ86Bw9oBQ +It8hELrRN+EYt9nv75lVHha+ZDUhCDNQVczDZVlDCBs +--- xzJ/50+WOA+IWRXiAvBbJLUlsgsSztQrzbimng2QdlU +Ϭjҍ8K7$wbԲǰ~]NB]QM+cw +Jo͔Sؚ!NDuOnZnNѵV:kc)|JopSHfu19 \ No newline at end of file diff --git a/hosts/marauder/secrets/restic-password.age b/hosts/marauder/secrets/restic-password.age index 58bbd5c66d43e5ccf66e1e1bcd8d3e55b07de816..6722ce542f8ef776c9fd8e734eac4e732a2a1d31 100644 GIT binary patch delta 210 zcmeyy_>FObPJMcEg^5S9U!HfWk#A5^j(bFsi&17uM43lUYJ{Ufh+9d4XL>-0M`l#G zCzq*FmWOvW^k2zmZ?v0iE(a0vU6IgW06~sBbTnOu7X)g zvOz$$Nn%Brfsa#gP*J6KU`Ux$S!rHsQcFObPQ7oKv%W!CWTvxMvQc(aNI`^4akiUzx?ypSab8%iQJ6`weom1=VYZ2T zI+t5cX}Z6kkDEtEqN#6ENU=w0aZa#LiFuHBdVaW*iF>$dX-;9Gm!Gzy374*}u0n>p zn@^OhTe!Jfl)ryeRe5+|MOI3IYoSMuc}{Vpo3XKPqIYqqg^OuAzCCAkMR%LGpDwgZqx8S$BTivO81v NW7kr>xv5Xq0sz0LPIv$S diff --git a/hosts/quasar/default.nix b/hosts/quasar/default.nix index 289cf4b..c4d5809 100644 --- a/hosts/quasar/default.nix +++ b/hosts/quasar/default.nix @@ -28,7 +28,7 @@ matrix-synapse-secrets.file = ./secrets/matrix-synapse-secrets.age; }; - services.postgresql = { enable = true; }; + services.postgresql.enable = true; services.caddy = { enable = true; diff --git a/hosts/quasar/secrets/matrix-synapse-secrets.age b/hosts/quasar/secrets/matrix-synapse-secrets.age index f8716bd7dc792c563d7f3a82ae069701e209c31c..5fba68282a14bb27a4c678752c43893479363b7b 100644 GIT binary patch delta 502 zcmZ3*JcDI|PJKaGk&AzzenD79m9MvBnoCAjaB@hMsj**VnR${=W@Ju5u1k(vMW|zN zGM8~+Mw&&qOK_57MxsZBkBh#3ain`jMR0nEk8irSb4o#$mrt0pfw^Ou0hg|wLUD11 zZfc5=si~o*LW-ApQof^tp;>u`NpWOET4Yi|zHv%URlUE7Z$^ZLMSeh_f0n7KlfPk# zyKi}FS#XvwSCq4hmq~_eNLpx6XhB|}iFRgSc1lsck&C;bL55LQfmdp>rI(pwQCU!^-n(63`s^;AeDg2z2g6_dQ(OG6OQGND z-@Tn~ZVS@_9^JNom3dF5&+#q)0k6}gTU;$}ZQfaXL3_`WM*rW@r}}T_7-z7(EA17{ z++BY9xa9jt(d2E50wOIpMCIM~`KO}rHL^`sJnNK_!j4HR#cTBn=0E?p)?UG3{W}0Y Cy3PIo delta 392 zcmbQivWj_vPQ7QDWpRqXv2mhtfQfHmd2wNwWtzKTK~%m`VOmaZj(22{QND|(etKzn zAXk29sHam(x}|HSX;6rhi(80yNSR|wpnHXPcu7i*Q%YlfPuf4zk5cGex9#^WxiXecAANaxwgN#w_%Q3P<>8zMsk_Ci2>Kb_1{;1W?JJ> znzTdWQ{4kCt9h1H%b0Rnzw0-wj+4!2Ql5LX!&r6^2lth_TJ*>Un<{w{3 z#RFf{1h<4}-Nnmfjg_vSU!lvDVXyGi!6cpM-ewV%hG)gUUl_HVPkI~8d@Az$pU3qQ z+ch666yIr%um4>?C(?8M$F|nD)h1gvy=IYIHs5(}&|Sw37rv;pXFr-B_(6wjUcK~; zWfMNUe7280LRm*H2?qr diff --git a/secrets.nix b/secrets.nix index 1e8ad6a..48f0c4b 100644 --- a/secrets.nix +++ b/secrets.nix @@ -1,10 +1,14 @@ let - marauder.nettika = + marauder = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHopty1QG8P+OfGxQ9CV0BI1IRB/q6yITzMZaZ6Zspid"; + astral = + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILRJf6qsNoITXPBdiFsmZuLR0dyP/D6WYNP/RQynl3kf"; + quasar = + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOoVsKoMEiA2G0WIC/6gFsNE09yhumWf4xnDuoRcD2Px"; in { - "hosts/marauder/secrets/restic-env.age".publicKeys = [ marauder.nettika ]; - "hosts/marauder/secrets/restic-password.age".publicKeys = - [ marauder.nettika ]; + "hosts/marauder/secrets/restic-env.age".publicKeys = [ marauder ]; + "hosts/marauder/secrets/restic-password.age".publicKeys = [ marauder ]; "hosts/quasar/secrets/matrix-synapse-secrets.age".publicKeys = - [ marauder.nettika ]; + [ marauder quasar ]; + "hosts/astral/secrets/vaultwarden-env.age".publicKeys = [ marauder astral ]; }