[Vaultwarden] outline

2025-12-18 18:57:42 +01:00
5 changed files with 127 additions and 90 deletions
--- a/machines/.sops.yaml
+++ b/machines/.sops.yaml
@@ -95,6 +95,13 @@ creation_rules:
      - *admin_kalipso_dsktp
      age:
      - *admin_atlan
+  - path_regex: vaultwarden/secrets.yaml$
+    key_groups:
+    - pgp:
+      - *admin_kalipso
+      - *admin_kalipso_dsktp
+      age:
+      - *admin_atlan
  - path_regex: .*/secrets/.*
    key_groups:
    - pgp:
--- a/machines/nextcloud/configuration.nix
+++ b/machines/nextcloud/configuration.nix
@@ -48,39 +48,11 @@ with lib;
    extraAppsEnable = true;
    extraApps = {
      inherit (config.services.nextcloud.package.packages.apps) contacts calendar polls registration collectives forms;
-
-      deckWithDrag = pkgs.php.buildComposerProject (finalAttrs: {
-        pname = "deck";
-        version = "1.0.0";
-        src = pkgs.fetchzip {
-          url = "https://github.com/nextcloud/deck/archive/refs/heads/stable32.zip";
-          hash = "sha256-eMHjfki+axEtlhV6518mlAzPhZxAZqEX7HiRsJf1vxo=";
-        };
-        composerNoDev = true;
-        vendorHash = pkgs.lib.fakeHash;
-        postInstall = ''
-          cp -r $out/share/php/deck/* $out/
-          rm -r $out/share
-        '';
-      });
-      
-      #deckWithDrag = pkgs.fetchNextcloudApp {
-      #  appName = "deck";
-      #  appVersion = "1.16.2";
-      #  license = "agpl3Plus";
-      #  teams = [ pkgs.lib.teams.nextcloud ];
-      #  url = "https://github.com/nextcloud-releases/deck/releases/download/v1.16.2/deck-v1.16.2.tar.gz";
-      #  hash = "sha256-rFymTIr7pOuMES3DMIOS7cvq+CEIekLZYLqz58TOP04=";
-      #  description = "";
-      #  homepage = "https://github.com/nextcloud/deck";
-      #  unpack = true;
-      #  patches = [
-      #    (pkgs.fetchpatch {
-      #      url = "https://git.dynamicdiscord.de/ahtlon/deck/commit/77cbcf42ca80dd32e450839f02faca2e5fed3761.patch";
-      #      sha256 = "sha256-agwFMwXO8WLL0+pdeKF/pA59V9ah9t590sCl1msQonA=";
-      #    })
-      #  ];
-      #};
+      deck = pkgs.fetchNextcloudApp {
+        sha256 = "sha256-1sqDmJpM9SffMY2aaxwzqntdjdcUaRySyaUDv9VHuiE=";
+        url = "https://link.storjshare.io/raw/jvrl62dakd6htpyxohjkiiqiw5ma/mal/deck32.tar.gz";
+        license = "agpl3Plus";
+      };
    };
    settings = {
      trusted_domains = ["10.0.0.13"];
--- a/machines/vaultwarden/configuration.nix
+++ b/machines/vaultwarden/configuration.nix
@@ -0,0 +1,60 @@
+{ config, lib, pkgs, inputs, ... }:
+
+with lib;
+
+{
+  sops.defaultSopsFile = ./secrets.yaml;
+  sops.secrets = {
+    vaultUser = {};
+    vaultPass = {};
+  };
+  networking = {
+    hostName = mkDefault "uptimekuma";
+    useDHCP = false;
+  };
+
+  imports = [
+    ../modules/malobeo_user.nix
+    ../modules/sshd.nix
+  ];
+
+  networking.firewall.allowedTCPPorts = [ 80 ];
+
+  services.nginx = {
+    enable = true;
+    virtualHosts."status.malobeo.org" = {
+      locations."/" = {
+        proxyPass = "http://127.0.0.1:3001";
+        extraConfig = ''
+        '';
+      };
+
+    };
+  };
+
+  services.vaultwarden = {
+    enable = true;
+    backupDir = "";
+    enviromentDile = sops.nochewas.file ;
+    config = {
+      DOMAIN = "keys.malobeo.org"; #maybe vault.malobeo.org
+      SIGNUPS_ALLOWED = true;
+      #WEBSERVER
+      ROCKET_ADDRESS = "::1";
+      ROCKET_PORT = 8222;
+      ROCKET_LOG = "critical";
+      #EMAIL
+      SMTP_HOST = "mail.systemli.org";
+      SMTP_PORT = 465;
+      SMTP_SECURITY = "force_tls";
+      SMTP_USERNAME = sops.smtpUser;
+      SMTP_PASSWORD = sops.smtpPass;
+
+      SMTP_FROM = "malobot@systemli.org";
+      SMTP_FROM_NAME = "Malobeo Vaultwarden Server";
+    };
+  };
+
+  system.stateVersion = "22.11"; # Did you read the comment?
+}
+
--- a/machines/vaultwarden/secrets.yaml
+++ b/machines/vaultwarden/secrets.yaml
@@ -0,0 +1,55 @@
+smtpUser: ENC[AES256_GCM,data:BsHFhpQtQ2Jhi3nuhJXjReJvbzU=,iv:jdSLeAgYj8JFSsLU3ZiVCG2ox8ZBo/HV6szCQUU5YWQ=,tag:XjS12SnmC6NNhWcTUvEhlA==,type:str]
+sops:
+    age:
+        - recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYRnd3NGpkWjZVZjYxZ2VP
+            QUpTMjNwTml3NW8zL2o2c2R0TE53aEtlK0JNCi9jTjhZVXNMZ29oNDIrbFJBenkz
+            UkVBKzBQVUlYREc3bkxRb1R6RE5MaUUKLS0tIDJmdmlidmZCOXU5dDdFRmY2Q2pu
+            bWhRZS9oamtQYnRZVnI1clVGNytHWlkKb1hYwkqfSiMCVFOWraCiWoAU1Ua/U0Kc
+            2UnXRByOST5hfKkTnpJ0765UATUny0K53H/ieMR0cyQxE3aCbk5AfA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-12-18T17:56:54Z"
+    mac: ENC[AES256_GCM,data:/TofX/71rLHMpin9hhKcXQRTuCb+CXkTkHtZozuqSL0SHR0hTacLNZrmkPlzYlxmvzYsJekBOWTfrhxOD5cOhdOhfsZ/zhXi0e3RVDBPDE//faARYvbQ9IJGsDOGQzaZopwXx098MVNGj3NP6XqDgCI5aDXfL8Uklg0ORTXfPwE=,iv:Th7+EY9BdV8nmMi7rYQjgLN8nxDOwNSiWy3movkyIAw=,tag:caMd5aeQbaVAWbYJYe5K+A==,type:str]
+    pgp:
+        - created_at: "2025-12-18T17:32:21Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQGMA5HdvEwzh/H7AQv/X02f2/84Twa9Sgj7husyP8ZOva1gsUnakZRd670K1Vxe
+            Z7eY4THMkP59qtbzCDkop0GulM1WNXd3jocT169WKYA5+myjNl131Ppn/DfAHMCk
+            QqguILH7K8X7zQkDU6Y4LE2sLuxYeoYz7aptdwoZpWZRKJjX6Q0pFrbFLZP54CJD
+            BXqcRAGHXSmr8lMJVmaQolzyn9B08Vv/D1LTfgI9qA+K+sxjKQopOjvv03NFSM67
+            PbNNqjQpToM2LaFJTfxXrwljRUkt1BN98wxKlFRIKVbb4spezYHFU+zf5XqM8+sg
+            V9mIGw/5lhYPfSB9EN/2mcqabaWFEqmhBRKRHVirXWBrUmvb5+cKTRQ93zM7Lipr
+            prz7MK+1DRxB5BgKxOiLTz+q/1JlmwpulxBBSSd8o3nHhpjEyaMBoa30TYuUWAVl
+            lW8zCC9H0H8vnqam2OXalu6tu8jvQ6AIquQGOKb3NtWf6pCTQNv0F7t0AWK2zkUL
+            WjrkEiG3lv3vGJeVGq9U0lgBj8HtXnnHsDMJkhPGClQeJcWiv7Tj8f79+Mni8QhM
+            dVWXVesg+dsUazptP35n2S2XlLY8Jk3tyD1KTLrt5R/MMGhAZOmgPS4I4q+zrZSj
+            S0Dj9iTJcJ/F
+            =YEYS
+            -----END PGP MESSAGE-----
+          fp: c4639370c41133a738f643a591ddbc4c3387f1fb
+        - created_at: "2025-12-18T17:32:21Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA98TrrsQEbXUAQ/+LMZHO0oxmlivnL1qKaDz5JKAL718pHmjshxc53gUo4aN
+            x9WC4USniK8IMV4MTZUxti/ekJ5Bxd+myMMIORHE4R1q1FNO1tWx9n8PXAVhIrDx
+            XF/2NZKzUzCHd3OE3GvS+LSTITLnJdtSuAOPA9MjOeC2TU52r3CkNxUfYMjLYIuk
+            soZi8HfTWVfXKyEq300CLdEqoiaN6lqaxY+e0LoiQjPTpZSs0KhpcjvvmKBpZI0x
+            temAZ+VbEU93DuCVxsXQAQria5GUYs66237goctBjto6G0uOyzJ3lOE17ThDkL8J
+            PpbmoR+CkT++lJnSeeRuhF5FYaVWPl0LDGVLAQrkeblGUjhLtzSrN/ZNyjhGaYdk
+            zlUOFUNVlaok1fcC+8PNsfcna7keLW+N4YPTeZQljjH1uWvdzIZaJto1TaDYrSyu
+            EVF4J0FDThMCu7fyf0TrbqE8n7xs/1F7BBfhUC0wWztX4sNo9mNBZK1d96ihFlzB
+            FRBjrAKCGSD4eZcwaJZB/4NoipFDUh9kmQemmSalDNaHjvdXsT4euY4JNqwKw2iK
+            76EYBym1fvEaOeYvoOotLU3vrW6dH0YNEf0+Zvtl8XiUHlDCnxeLaBoVybA7p+Rt
+            0J/S3wPMubikTuq3mSsJcUM8c25sRBD90LjZsAcwKbmfDZntkTNGUr3AEaBdEyTS
+            WAGKfeJiKoH24BQrslUV8V4i4Fcz6xh1tb11Dmg9XcEiZm4+IF/P+UvjHgXanVdu
+            GvEauo1dOpGu+L8xc68fSFfMNQcWDJ1UmZIyJ3FLDbaxI/66H041peA=
+            =YUFg
+            -----END PGP MESSAGE-----
+          fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0
--- a/outputs.nix
+++ b/outputs.nix
@@ -74,63 +74,6 @@ in (utils.lib.eachSystem (builtins.filter filter_system utils.lib.defaultSystems
        '';
      };

-      #deckWithDrag = pkgs.buildNpmPackage {
-      #  name = "deckWithDrag";
-      #  version = "1.16.2";
-      #  src = pkgs.fetchFromGitHub {
-      #    owner = "nextcloud";
-      #    repo = "deck";
-      #    rev = "v1.16.2";
-      #    hash = "sha256-NBkCdMjIY2r+AgCLBt4YnD4sUW7GTKxT5vHAmpk4wno=";
-      #    leaveDotGit = true;
-      #  };
-
-      #  makeCacheWritable = true;
-      #  npmDepsHash = "sha256-VaKfpYFtrTUvGbKORPvex1FvLz4vR7zfHAf+fdf/6OE=";
-
-      #  buildInputs = with pkgs; [
-      #    gnumake krankerl php84Packages.composer php nodejs_24
-      #  ];
-
-      #  patches = [
-      #    (pkgs.fetchpatch {
-      #      url = "https://git.dynamicdiscord.de/ahtlon/deck/commit/77cbcf42ca80dd32e450839f02faca2e5fed3761.patch";
-      #      sha256 = "sha256-agwFMwXO8WLL0+pdeKF/pA59V9ah9t590sCl1msQonA=";
-      #    })
-      #  ];
-
-      #  buildPhase = ''
-      #    ${pkgs.krankerl}/bin/krankerl package
-      #  '';
-      #};
-
-      deckWithDrag = pkgs.stdenv.mkDerivation {
-        name = "deckWithDrag";
-        src = pkgs.fetchFromGitHub {
-          owner = "nextcloud";
-          repo = "deck";
-          rev = "v1.16.2";
-          hash = "sha256-NBkCdMjIY2r+AgCLBt4YnD4sUW7GTKxT5vHAmpk4wno=";
-          leaveDotGit = true;
-        };
-
-        buildInputs = with pkgs; [
-          gnumake krankerl php84Packages.composer php nodejs_24
-        ];
-
-        patches = [
-          (pkgs.fetchpatch {
-            url = "https://git.dynamicdiscord.de/ahtlon/deck/commit/77cbcf42ca80dd32e450839f02faca2e5fed3761.patch";
-            sha256 = "sha256-agwFMwXO8WLL0+pdeKF/pA59V9ah9t590sCl1msQonA=";
-          })
-        ];
-
-        buildPhase = ''
-          make release
-          #${pkgs.krankerl}/bin/krankerl package
-        '';
-      };
-
      run-vm = pkgs.writeShellScriptBin "run-vm"  (builtins.readFile ./scripts/run-vm.sh);
    };