vaultwarden and postgresql

imports/caddy.nix

@@ -0,0 +1,20 @@
+{ config, lib, pkgs, ... }:
+
+{
+  services.caddy = {
+    enable = true;
+  
+    virtualHosts."http://navidrome.mymarseille.duckdns.org".extraConfig = ''
+      reverse_proxy localhost:4533
+    '';
+
+    virtualHosts."http://notes.mymarseille.duckdns.org".extraConfig = ''
+      reverse_proxy localhost:8001
+    '';
+
+    virtualHosts."http://vault.mymarseille.duckdns.org".extraConfig = ''
+      reverse_proxy localhost:8000
+    '';
+
+  };
+}

imports/hedgedoc.nix

@@ -0,0 +1,11 @@
+{ config, lib, pkgs, ... }:
+{
+  services.hedgedoc = {
+    enable = true;
+    settings = {
+      domain = "hedgedoc.mymarseille.duckdns.org";
+      port = 8001;
+    };
+  };
+
+}

imports/navidrome.nix

@@ -0,0 +1,11 @@
+{ config, lib, pkgs, ... }:
+{
+ services.navidrome = {
+    enable = true;
+    settings = {
+      Address = "0.0.0.0";
+      Port = 4533;
+      MusicFolder = "/srv/music";
+    };
+  };
+}

imports/postgres.nix

@@ -0,0 +1,25 @@
+{ config, lib, pkgs, ... }:
+{
+  services.postgresql = {
+    enable = true;
+
+    ensureDatabases = [ "vaultwarden" ];
+    authentication = pkgs.lib.mkOverride 10 ''
+      #type database  DBuser  auth-method
+      local all       all     trust
+    '';
+
+    # When removing users or removing permissions from users here, must also remove them manually
+    ensureUsers = [
+      {
+        name = "vaultwarden";
+        ensureDBOwnership = true; 
+      }
+    ];
+
+    
+    settings = {
+      port = 5432;
+    };
+  };
+}

imports/vaultwarden.nix

@@ -0,0 +1,31 @@
+{ config, lib, pkgs, ... }:
+{
+  services.vaultwarden = {
+    enable = true;
+    dbBackend = "postgresql";
+    
+    # backupDir = "/srv/backup/vaultwarden"; # optional for backups
+    config = {
+      ROCKET_PORT = 8000;
+      DOMAIN = "https://vault.mymarseille.duckdns.org";
+      SIGNUPS_ALLOWED = false;
+
+      ADMIN_TOKEN = "$argon2id$v=19$m=65540,t=3,p=4$djJtbTZsUlhBY0lxWldqSFV2NEUwNloxRlF0Uk5VVmFOalFmT0hQaHBoMD0$Ekj+ymeGJXyx84GCE3wN123f/Khdcw1GGPMv+s1tqmU";
+      
+      DATABASE_URL="postgresql://:5432/vaultwarden";
+      
+      SMTP_FROM = "vincentwaltz8@gmail.com";
+      SMTP_FROM_NAME = "VaultWarden";
+      SMTP_HOST = "smtp.gmail.com";
+      SMTP_USERNAME = "vincentwaltz8@gmail.com";
+      SMTP_PASSWORD = "iieu nrwc abtb vdqh";
+    };
+
+  };
+
+  systemd.services.vaultwarden = {
+      requires = [ "postgresql.service" ];
+      after = [ "postgresql.service" ];
+  };
+  
+}

imports/wireguard.nix

@@ -0,0 +1,40 @@
+{ config, lib, pkgs, ... }:
+{
+  # Enable WireGuard
+  networking.wireguard.enable = true;
+  networking.wireguard.interfaces = {
+    # "wg0" is the network interface name. You can name the interface arbitrarily.
+    tr = {
+      # Determines the IP address and subnet of the client's end of the tunnel interface.
+      ips = [ "10.0.1.2/24" ];
+      #listenPort = 51821; # to match firewall allowedUDPPorts (without this wg uses random port numbers)
+
+      # Path to the private key file.
+      #
+      # Note: The private key can also be included inline via the privateKey option,
+      # but this makes the private key world-readable; thus, using privateKeyFile is
+      # recommended.
+      privateKeyFile = "/root/wireguard-keys/private";
+
+      peers = [
+        # For a client configuration, one peer entry for the server will suffice.
+
+        {
+          # Public key of the server (not a file path).
+          publicKey = "TSPq7sJbY9DNhCu76sc0s9wtFnfHhk/ud0D/JiEPfV4=";
+
+          # Forward all the traffic via VPN.
+          allowedIPs = [ "10.0.1.1" ];
+          # Or forward only particular subnets
+          #allowedIPs = [ "10.100.0.1" "91.108.12.0/22" ];
+
+          # Set this to the server IP and port.
+          endpoint = "79.72.30.126:51821"; # ToDo: route to endpoint not automatically configured https://wiki.archlinux.org/index.php/WireGuard#Loop_routing https://discourse.nixos.org/t/solved-minimal-firewall-setup-for-wireguard-client/7577
+
+          # Send keepalives every 25 seconds. Important to keep NAT tables alive.
+          persistentKeepalive = 25;
+        }
+      ];
+    };
+  };
+}