From 2bc5f5ae6503a9fb706039f8b73b415be0f9d5cd Mon Sep 17 00:00:00 2001
From: Raphael <rparodi@student.42.fr>
Date: Sun, 8 Mar 2026 18:01:21 +0100
Subject: [PATCH] feat(services/self_host): adding the vault configuration

---
 services/self_host/vault.nix | 35 +++++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)
 create mode 100644 services/self_host/vault.nix

diff --git a/services/self_host/vault.nix b/services/self_host/vault.nix
new file mode 100644
index 0000000..62f1511
--- /dev/null
+++ b/services/self_host/vault.nix
@@ -0,0 +1,35 @@
+{ config, ... }:
+
+let
+  vaultEnv = config.age.secrets.vault-secret-env.path;
+in
+{
+  services.vaultwarden = {
+    enable = true;
+
+    environmentFile = vaultEnv;
+
+    config = {
+      DOMAIN = "https://vault.enium.eu";
+      ROCKET_PORT = 8222;
+      SIGNUPS_ALLOWED = false;
+      SSO_ENABLED = true;
+      SSO_CLIENT_ID = "vault";
+      SSO_CLIENT_SECRET = "cat ${config.age.secrets.vault-oidc-secret.path}";
+      SSO_AUTHORITY = "https://auth.enium.eu/oauth2/openid/vault";
+      SSO_SIGNUPS_MATCH_EMAIL = true;
+      SSO_PKCE = true;
+      SSO_SCOPES = "openid profile email";
+      SSO_ONLY = true;
+    };
+  };
+
+  services.nginx.virtualHosts."vault.enium.eu" = {
+    forceSSL = true;
+    enableACME = true;
+    locations."/" = {
+      proxyPass = "http://127.0.0.1:8222";
+      proxyWebsockets = true;
+    };
+  };
+}