raphael/nixos
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(services/self_host): adding the vault configuration

Browse source
This commit is contained in:
Raphael 2026-03-08 18:01:21 +01:00
parent 846ccf3475
commit 2bc5f5ae65
No known key found for this signature in database
1 changed files with 35 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

35
services/self_host/vault.nix Normal file
View file

@ -0,0 +1,35 @@
{ config, ... }:
let
vaultEnv = config.age.secrets.vault-secret-env.path;
in
{
services.vaultwarden = {
enable = true;
environmentFile = vaultEnv;
config = {
DOMAIN = "https://vault.enium.eu";
ROCKET_PORT = 8222;
SIGNUPS_ALLOWED = false;
SSO_ENABLED = true;
SSO_CLIENT_ID = "vault";
SSO_CLIENT_SECRET = "cat ${config.age.secrets.vault-oidc-secret.path}";
SSO_AUTHORITY = "https://auth.enium.eu/oauth2/openid/vault";
SSO_SIGNUPS_MATCH_EMAIL = true;
SSO_PKCE = true;
SSO_SCOPES = "openid profile email";
SSO_ONLY = true;
};
};
services.nginx.virtualHosts."vault.enium.eu" = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://127.0.0.1:8222";
proxyWebsockets = true;
};
};
}