feat(MOMO): setup syncthing and vaultwarden

hosts/MOMO/services/acme.nix

@@ -0,0 +1,7 @@
+{ ... }:
+{
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "gendulf@posteo.de";
+  };
+}

hosts/MOMO/services/default.nix

@@ -0,0 +1,9 @@
+{
+  imports = [
+    ./acme.nix
+    ./nginx.nix
+    ./postgresql.nix
+    ./syncthing.nix
+    ./vaultwarden.nix
+  ];
+}

hosts/MOMO/services/nginx.nix

@@ -0,0 +1,27 @@
+{ ... }:
+{
+  services.nginx = {
+    enable = true;
+    virtualHosts."syncthing.dryb.org" = {
+      addSSL = true;
+      enableACME = true;
+      locations."/" = {
+        proxyPass = "http://127.0.0.1:8384";
+      };
+    };
+    virtualHosts."vaultwarden.dryb.org" = {
+      addSSL = true;
+      enableACME = true;
+      locations."/" = {
+        proxyPass = "http://127.0.0.1:8005";
+      };
+    };
+  };
+
+  networking.firewall = {
+    allowedTCPPorts = [
+      80
+      443
+    ];
+  };
+}

hosts/MOMO/services/postgresql.nix

@@ -0,0 +1,26 @@
+{ ... }:
+{
+
+  services.postgresql = {
+    enable = true;
+    ensureDatabases = [ "vaultwarden" ];
+
+    ensureUsers = [
+      {
+        name = "vaultwarden";
+        ensureDBOwnership = true;
+      }
+    ];
+
+    # type   database     DBuser  auth-method  mapping
+    authentication = ''
+      local  vaultwarden  all     ident        map=vaultwarden-users
+    '';
+
+    # name               sysuser        dbuser
+    identMap = ''
+      vaultwarden-users  vaultwarden    vaultwarden
+    '';
+  };
+
+}

hosts/MOMO/services/syncthing.nix

@@ -0,0 +1,7 @@
+{ ... }:
+{
+  services.syncthing = {
+    enable = true;
+    openDefaultPorts = true;
+  };
+}

hosts/MOMO/services/vaultwarden.nix

@@ -0,0 +1,27 @@
+{ config, ... }:
+{
+  age.secrets.environments-vaultwarden = {
+    file = ../../../secrets/environments/vaultwarden.age;
+  };
+
+  users.users.vaultwarden = {
+    description = "Vaultwarden Service";
+    home = "/var/lib/bitwarden_rs";
+    useDefaultShell = true;
+    isSystemUser = true;
+  };
+
+  services.vaultwarden = {
+    enable = true;
+    dbBackend = "postgresql";
+    environmentFile = config.age.secrets.environments-vaultwarden.path;
+    config = {
+      DOMAIN = "http://vaultwarden.dryb.org";
+      SIGNUPS_ALLOWED = false;
+      ROCKET_ADDRESS = "127.0.0.1";
+      ROCKET_PORT = 8005;
+      DATABASE_URL = "postgresql:///vaultwarden";
+      WEB_VAULT_ENABLED = true;
+    };
+  };
+}