lyes/nixfiles
1
0
Fork 0
Code Issues Pull requests Activity Actions

Adding vaultwarden

Browse source
This commit is contained in:
Lyes Saadi 2025-10-15 04:18:07 +02:00
parent 9e23ce9d90
commit 331b403a74
Signed by: lyes
GPG key ID: 55A1D803917CF39A
5 changed files with 43 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

35
modules/server/giovanni/default.nix Normal file
View file

@ -0,0 +1,35 @@
{ config, lib, ... }:
{
services.vaultwarden = {
enable = true;
dbBackend = "postgresql";
environmentFile = config.age.secrets.giovanni-env.path;
config = {
ROCKET_PORT = 44301;
SENDMAIL_COMMAND = "${config.security.wrapperDir}/sendmail";
};
};
systemd.services.vaultwarden = {
path = [ "/run/wrappers" ];
serviceConfig = {
NoNewPrivileges = lib.mkForce false;
PrivateUsers = lib.mkForce false;
SystemCallFilter = lib.mkForce [ "@system-service" ];
RestrictAddressFamilies = [
"AF_LOCAL"
"AF_NETLINK"
];
ReadWritePaths = [ "/var/spool/mail/" ];
};
};
age.secrets = {
giovanni-env = {
file = ../../../secrets/zora/services/giovanni-env.age;
};
};
}