adriangl
566732a02c
Add a general environment.snakeoil-certs module that generates self-signed certs at runtime (oneshot service + daily timer, idempotent via x509 -checkend). Terminate TLS for vaultwarden with nginx on port 8001 -> 127.0.0.1:8000 using a snakeoil cert, so it's reachable over the tailnet IP without the broken public reverse proxy.
70 lines
1.5 KiB
Nix
70 lines
1.5 KiB
Nix
{
|
|
config,
|
|
pkgs,
|
|
lib,
|
|
...
|
|
}:
|
|
{
|
|
|
|
environment.systemPackages = [
|
|
pkgs.system-sendmail
|
|
];
|
|
|
|
sops.secrets."vaultwarden/environmentFile" = {
|
|
restartUnits = [ "vaultwarden.service" ];
|
|
owner = "vaultwarden";
|
|
mode = "0755";
|
|
};
|
|
|
|
services.vaultwarden = {
|
|
enable = true;
|
|
environmentFile = config.sops.secrets."vaultwarden/environmentFile".path;
|
|
dbBackend = "sqlite";
|
|
backupDir = "/var/backup/vaultwarden";
|
|
};
|
|
|
|
environment.snakeoil-certs.vaultwarden = {
|
|
owner = "nginx";
|
|
group = "nginx";
|
|
subject = "/CN=vaultwarden";
|
|
extraOpenSSLArgs = [
|
|
"-addext"
|
|
"subjectAltName=DNS:galadriel,DNS:*.galadriel,DNS:localhost,IP:127.0.0.1,IP:100.110.96.125"
|
|
];
|
|
};
|
|
|
|
services.nginx = {
|
|
enable = lib.mkDefault true;
|
|
recommendedProxySettings = true;
|
|
virtualHosts."vaultwarden" = {
|
|
onlySSL = true;
|
|
sslCertificate = config.environment.snakeoil-certs.vaultwarden.certificate;
|
|
sslCertificateKey = config.environment.snakeoil-certs.vaultwarden.certificateKey;
|
|
listen = [
|
|
{
|
|
addr = "0.0.0.0";
|
|
port = 8001;
|
|
ssl = true;
|
|
}
|
|
{
|
|
addr = "[::]";
|
|
port = 8001;
|
|
ssl = true;
|
|
}
|
|
];
|
|
locations."/" = {
|
|
proxyPass = "http://127.0.0.1:8000";
|
|
proxyWebsockets = true;
|
|
};
|
|
};
|
|
};
|
|
|
|
systemd.services.nginx = {
|
|
after = [ "generate-snakeoil-certs.service" ];
|
|
wants = [ "generate-snakeoil-certs.service" ];
|
|
};
|
|
|
|
networking.firewall.allowedTCPPorts = [ 8001 ];
|
|
|
|
}
|