Setup vaultwarden on astral

hosts/astral/default.nix

@@ -1,9 +1,10 @@
-{ nixosModules, modulesPath, lib, pkgs, ... }: {
+{ modulesPath, nixosModules, agenix, lib, pkgs, config, ... }: {
   imports = [
     "${modulesPath}/virtualisation/amazon-image.nix"
     nixosModules.nano
     nixosModules.nettika
     nixosModules.promptmoji
+    agenix.nixosModules.default
   ];
 
   boot.loader.grub.device = lib.mkForce "/dev/nvme0n1";
@@ -14,7 +15,10 @@
       dates = "weekly";
       options = "--delete-older-than 30d";
     };
-    settings.trusted-users = [ "@wheel" ];
+    settings = {
+      trusted-users = [ "@wheel" ];
+      experimental-features = [ "nix-command" "flakes" ];
+    };
   };
 
   networking = {
@@ -22,6 +26,8 @@
     firewall.allowedTCPPorts = [ 80 443 ];
   };
 
+  age.secrets.vaultwarden-env.file = ./secrets/vaultwarden-env.age;
+
   users.defaultUserShell = pkgs.fish;
 
   security.sudo.wheelNeedsPassword = false;
@@ -33,9 +39,28 @@
         respond "astral is online"
         header Strict-Transport-Security: "max-age=63072000; includeSubDomains"
       '';
+      "vault.leaf.ninja".extraConfig = ''
+        reverse_proxy localhost:8222
+      '';
     };
   };
 
+  services.vaultwarden = {
+    enable = true;
+    config = {
+      domain = "https://vault.leaf.ninja";
+      signupsAllowed = false;
+      rocketAddress = "0.0.0.0";
+      rocketPort = 8222;
+      smtpHost = "smtp.migadu.com";
+      smtpFrom = "vaultwarden@leaf.ninja";
+      smtpPort = 587;
+      smtpSecurity = "starttls";
+      smtpUsername = "vaultwarden@leaf.ninja";
+    };
+    environmentFile = config.age.secrets.vaultwarden-env.path;
+  };
+
   programs.fish.enable = true;
 
   documentation.man.generateCaches = false;

hosts/default.nix

@@ -1,25 +1,24 @@
 { self, nixpkgs, phps, agenix, ... }:
-let inherit (nixpkgs.lib) nixosSystem;
+let
+  baseSpecialArgs = {
+    inherit (self) nixosModules;
+    inherit agenix;
+  };
+  nixosSystem = args:
+    nixpkgs.lib.nixosSystem
+    (nixpkgs.lib.recursiveUpdate args { specialArgs = baseSpecialArgs; });
 in {
   marauder = nixosSystem {
     system = "x86_64-linux";
     modules = [ ./marauder ];
-    specialArgs = {
+    specialArgs = { inherit phps; };
-      inherit (self) nixosModules;
-      inherit phps agenix;
-    };
   };
   astral = nixosSystem {
     system = "x86_64-linux";
     modules = [ ./astral ];
-    specialArgs = { inherit (self) nixosModules; };
   };
   quasar = nixosSystem {
     system = "x86_64-linux";
     modules = [ ./quasar ];
-    specialArgs = {
-      inherit (self) nixosModules;
-      inherit agenix;
-    };
   };
 }

hosts/marauder/secrets/restic-env.age

@@ -1,5 +1,6 @@
 age-encryption.org/v1
--> ssh-ed25519 f+PJrQ qccE2xAzfBZ3DCRQtQDgwS1UzjlZx44oUrYjcDfMfDk
+-> ssh-ed25519 f+PJrQ VJshLBSbF93anR9fOJ3Kwhxh1AOdvsS0hoJ86Bw9oBQ
-I2l6xRJsdQLYB2cMo0Kfi6mVyhZsuSPFG574P8pl12Y
+It8hELrRN+EYt9nv75lVHha+ZDUhCDNQVczDZVlDCBs
---- WoBlo7fqYRkiBYPoLpa3wHB8ZPCVy32a4aL5UswCHJc
+--- xzJ/50+WOA+IWRXiAvBbJLUlsgsSztQrzbimng2QdlU
-LŁćΚČ[¤Nî<#Ő]<5D>
ź<>üBÄ}–×fË%P„ôxK±Ű¨ţkI˝©”<§V<C2A7>ź…¶YÄ5#ĺ±đ÷ű”qEł4’­®¶l—ËřFľ“8ukȨ<C48C>űÂ%Ŕ´U53yěű"Ťg\î<>©ŞZćŮC®őWĄ˛g­z
+<EFBFBD>´Ï¬jÒ<>ÿ8K7$ðwÃbԲǰ€Ì~]NBª]QÐM+cw
+þþÔJ•o—Í”ÔSîØš!N¨Du¦OÈnçZnNâæÍѵV¬:ŒŸ®¬kúÝcó)|æŒJ…opÇSÎH˜«f§ùØu1šã9Çå

hosts/quasar/default.nix

@@ -28,7 +28,7 @@
     matrix-synapse-secrets.file = ./secrets/matrix-synapse-secrets.age;
   };
 
-  services.postgresql = { enable = true; };
+  services.postgresql.enable = true;
 
   services.caddy = {
     enable = true;

secrets.nix

@@ -1,10 +1,14 @@
 let
-  marauder.nettika =
+  marauder =
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHopty1QG8P+OfGxQ9CV0BI1IRB/q6yITzMZaZ6Zspid";
+  astral =
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILRJf6qsNoITXPBdiFsmZuLR0dyP/D6WYNP/RQynl3kf";
+  quasar =
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOoVsKoMEiA2G0WIC/6gFsNE09yhumWf4xnDuoRcD2Px";
 in {
-  "hosts/marauder/secrets/restic-env.age".publicKeys = [ marauder.nettika ];
+  "hosts/marauder/secrets/restic-env.age".publicKeys = [ marauder ];
-  "hosts/marauder/secrets/restic-password.age".publicKeys =
+  "hosts/marauder/secrets/restic-password.age".publicKeys = [ marauder ];
-    [ marauder.nettika ];
   "hosts/quasar/secrets/matrix-synapse-secrets.age".publicKeys =
-    [ marauder.nettika ];
+    [ marauder quasar ];
+  "hosts/astral/secrets/vaultwarden-env.age".publicKeys = [ marauder astral ];
 }