massicot: add vaultwarden server

flake.nix

@@ -85,11 +85,12 @@
           };
 
           massicot = { name, nodes, pkgs, ... }: with inputs; {
-              deployment.targetHost = "***REMOVED***";
+              deployment.targetHost = "49.13.13.122";
-              deployment.targetUser = "root";
+              deployment.targetUser = "xin";
 
               imports = [
                   { nixpkgs.system = "aarch64-linux"; }
+                  self.nixosModules.default
                   machines/massicot
               ];
           };

machines/massicot/services.nix

@@ -6,6 +6,11 @@ in
   networking.firewall.allowedTCPPorts = [ 80 443 2222 8448 ];
   networking.firewall.allowedUDPPorts = [ 80 443 8448 ];
 
+  custom.vaultwarden = {
+    enable = true;
+    domain = "vaultwarden.xinyang.life";
+  };
+
   fileSystems = builtins.listToAttrs (map (share: {
     name = "/mnt/storage/${share}";
     value = { 

modules/nixos/default.nix

@@ -2,5 +2,6 @@
 {
   imports = [
     ./restic.nix
+    ./vaultwarden.nix
   ];
 }

modules/nixos/vaultwarden.nix

@@ -0,0 +1,47 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+  cfg = config.custom.vaultwarden;
+in
+{
+  options = {
+    custom.vaultwarden = {
+      enable = mkEnableOption "vaultwarden server";
+      domain = mkOption {
+        type = types.str;
+        default = "bitwarden.example.com";
+        description = "Domain name of the vaultwarden server";
+      };
+      caddy = mkOption {
+        type = types.bool;
+        default = true;
+        description = "Enable Caddy as reverse proxy";
+      };
+      # TODO: mailserver support
+    };
+  };
+  config = {
+    services.vaultwarden = mkIf cfg.enable {
+      enable = true;
+      dbBackend = "sqlite";
+      config = {
+        DOMAIN = "https://${cfg.domain}";
+        SIGNUPS_ALLOWED = false;
+
+        ROCKET_ADDRESS = "127.0.0.1";
+        ROCKET_PORT = 8222;
+
+        ROCKET_LOG = "critical";
+      };
+    };
+    services.caddy = mkIf cfg.caddy {
+      enable = true;
+      virtualHosts."https://${cfg.domain}".extraConfig = ''
+        reverse_proxy ${config.services.vaultwarden.config.ROCKET_ADDRESS}:${toString config.services.vaultwarden.config.ROCKET_PORT}
+      '';
+    };
+  };
+}
+