liv/nixos-config
1
0
Fork 0
mirror of https://github.com/Ahwxorg/nixos-config.git synced 2025-12-04 06:50:14 +01:00
Code Issues 1 Projects Releases Packages Wiki Activity Actions

feat: adds borgbackup job for vaultwarden

Browse source
This commit is contained in:
Ahwx 2025-08-17 14:11:42 +02:00
parent fa9bff88da
commit 5cc46993c8
1 changed files with 63 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

90
modules/services/vaultwarden.nix
View file

@ -1,34 +1,70 @@
{ config, ... }:
{
services.vaultwarden = {
enable = true;
dbBackend = "sqlite";
config = {
SIGNUPS_ALLOWED = false;
ENABLE_WEBSOCKET = true;
SENDS_ALLOWED = true;
INVITATIONS_ENABLED = true;
EMERGENCY_ACCESS_ALLOWED = true;
EMAIL_ACCESS_ALLOWED = true;
DOMAIN = "https://passwords.liv.town";
ROCKET_ADDRESS = "0.0.0.0";
ROCKET_PORT = 8003;
config,
host,
pkgs,
username,
...
}:
let
baseRepo = "ssh://liv@dandelion:9123/spinners/rootvol/backups/${host}";
in
{
services = {
vaultwarden = {
enable = true;
dbBackend = "sqlite";
config = {
SIGNUPS_ALLOWED = false;
ENABLE_WEBSOCKET = true;
SENDS_ALLOWED = true;
INVITATIONS_ENABLED = true;
EMERGENCY_ACCESS_ALLOWED = true;
EMAIL_ACCESS_ALLOWED = true;
DOMAIN = "https://passwords.liv.town";
ROCKET_ADDRESS = "0.0.0.0";
ROCKET_PORT = 8003;
};
};
};
services.nginx = {
enable = true;
recommendedProxySettings = true;
recommendedTlsSettings = true;
virtualHosts = {
"passwords.liv.town" = {
forceSSL = true;
sslCertificate = "/var/lib/acme/liv.town/cert.pem";
sslCertificateKey = "/var/lib/acme/liv.town/key.pem";
locations."/" = {
proxyPass = "http://127.0.0.1:${toString config.services.vaultwarden.config.ROCKET_PORT}/";
proxyWebsockets = true;
nginx = {
enable = true;
recommendedProxySettings = true;
recommendedTlsSettings = true;
virtualHosts = {
"passwords.liv.town" = {
forceSSL = true;
sslCertificate = "/var/lib/acme/liv.town/cert.pem";
sslCertificateKey = "/var/lib/acme/liv.town/key.pem";
locations."/" = {
proxyPass = "http://127.0.0.1:${toString config.services.vaultwarden.config.ROCKET_PORT}/";
proxyWebsockets = true;
};
};
};
};
borgbackup.jobs."violet-vaultwarden" = {
paths = [ "/var/lib/bitwarden_rs" ];
repo = "${baseRepo}/var-vaultwarden";
encryption.mode = "none";
compression = "auto,zstd";
startAt = "daily";
preHook = ''
systemctl stop vaultwarden
'';
postHook = ''
systemctl start vaultwarden
if [ $exitStatus -eq 2 ]; then
${pkgs.ntfy-sh}/bin/ntfy send https://notify.liv.town/${host} "borgbackup: ${host} backup (vaultwarden) failed with errors"
else
${pkgs.ntfy-sh}/bin/ntfy send https://notify.liv.town/${host} "borgbackup: ${host} backup (vaultwarden) completed succesfully with exit status $exitStatus"
fi
'';
user = "root";
extraCreateArgs = [
"--stats"
];
environment = {
BORG_RSH = "ssh -p 9123 -i /home/${username}/.ssh/id_ed25519";
};
};
};
}