VSinerva/nixos-conf
1
0
Fork 0
Code Activity Actions

Vaultwarden to cert-store

Browse source
This commit is contained in:
Vili Sinervä 2025-01-20 23:18:33 +02:00
parent 3c9f55eb8c
commit a840a276ae
No known key found for this signature in database
GPG key ID: DF8FEAF54EFAC996
3 changed files with 5 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

1
services/acme-cert-store.nix
View file

@ -6,6 +6,7 @@
openssh.authorizedKeys.keys = config.users.users.root.openssh.authorizedKeys.keys ++ [ openssh.authorizedKeys.keys = config.users.users.root.openssh.authorizedKeys.keys ++ [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHj2PK6LHsanSqaz8Gf/VqHaurd5e6Y7KnZNBiHb9adT nextcloud" "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHj2PK6LHsanSqaz8Gf/VqHaurd5e6Y7KnZNBiHb9adT nextcloud"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDiJZWlmiEkVzlf5/KV/jKkCGlgp8mnEeCnwk/dhdctJ gitea" "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDiJZWlmiEkVzlf5/KV/jKkCGlgp8mnEeCnwk/dhdctJ gitea"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOgIXTr7HxC13UNZP0UCALBRJuiDh4U0Nnd4GPIE4RQR vaultwarden"
]; ];
}; };

16
services/acme-dns.nix
View file

@ -1,16 +0,0 @@
{ ... }:
{
security.acme = {
acceptTerms = true;
defaults = {
email = "vili.m.sinerva@gmail.com";
environmentFile = "/var/lib/acme/dns-creds";
dnsProvider = "ovh";
group = "nginx";
extraLegoFlags = [
"--dns.propagation-wait"
"60s"
];
};
};
}

11
services/vaultwarden.nix
View file

@ -1,11 +1,8 @@
{ ... }: { ... }:
{ {
imports = [ ./acme-dns.nix ]; imports = [ ./cert-store-client.nix ];
networking.firewall.allowedTCPPorts = [ networking.firewall.allowedTCPPorts = [ 443 ];
80
443
];
networking.firewall.allowedUDPPorts = [ 443 ]; networking.firewall.allowedUDPPorts = [ 443 ];
services = { services = {
@ -43,8 +40,8 @@
virtualHosts."vaultwarden.vsinerva.fi" = { virtualHosts."vaultwarden.vsinerva.fi" = {
forceSSL = true; forceSSL = true;
kTLS = true; kTLS = true;
enableACME = true; sslCertificate = "/mnt/acme/fullchain.pem";
acmeRoot = null; sslCertificateKey = "/mnt/acme/key.pem";
locations."/" = { locations."/" = {
proxyPass = "http://localhost:8000"; proxyPass = "http://localhost:8000";
}; };