From 82493de787f19878d07b49ea22267a7dd4b22a71 Mon Sep 17 00:00:00 2001
From: tux <t@tux.rs>
Date: Fri, 7 Aug 2026 04:13:42 +0530
Subject: [PATCH] feat: add vaultwarden module

---
 modules/hosts/alpha/config.nix         |  6 +++
 modules/nixos/services/vaultwarden.nix | 68 ++++++++++++++++++++++++++
 2 files changed, 74 insertions(+)
 create mode 100644 modules/nixos/services/vaultwarden.nix

diff --git a/modules/hosts/alpha/config.nix b/modules/hosts/alpha/config.nix
index 39c790d..ee05a95 100644
--- a/modules/hosts/alpha/config.nix
+++ b/modules/hosts/alpha/config.nix
@@ -55,6 +55,12 @@
 
             environmentFile = innerArgs.config.sops.secrets."mediaflow-proxy".path;
           };
+
+          vaultwarden = {
+            enable = true;
+            port = 9999;
+            domain = "bw.lab.tux.rs";
+          };
         };
 
         virtualisation = {
diff --git a/modules/nixos/services/vaultwarden.nix b/modules/nixos/services/vaultwarden.nix
new file mode 100644
index 0000000..116194d
--- /dev/null
+++ b/modules/nixos/services/vaultwarden.nix
@@ -0,0 +1,68 @@
+{
+  flake.modules.nixos.services =
+    {
+      config,
+      lib,
+      ...
+    }:
+    with lib;
+    let
+      cfg = config.tnix.services.vaultwarden;
+    in
+    {
+      options.tnix.services.vaultwarden = {
+        enable = mkEnableOption "Enable Vaultwarden";
+
+        port = mkOption {
+          type = types.int;
+          default = 8000;
+        };
+
+        domain = mkOption {
+          type = types.str;
+          default = "";
+        };
+      };
+
+      config = mkIf cfg.enable {
+        services = {
+          vaultwarden = {
+            enable = true;
+            dbBackend = "postgresql";
+            config = {
+              ROCKET_ADDRESS = "127.0.0.1";
+              ROCKET_PORT = cfg.port;
+              DOMAIN = "https://${cfg.domain}";
+
+              DATABASE_URL = "postgresql:///vaultwarden?host=/run/postgresql";
+              ENABLE_WEBSOCKET = true;
+              SIGNUPS_ALLOWED = true;
+              DISABLE_ICON_DOWNLOAD = true;
+            };
+          };
+
+          nginx.virtualHosts.${cfg.domain} = {
+            forceSSL = true;
+            useACMEHost = "lab.tux.rs";
+            locations = {
+              "/" = {
+                proxyPass = "http://localhost:${toString cfg.port}";
+                proxyWebsockets = true;
+              };
+            };
+          };
+
+          postgresql = {
+            enable = true;
+            ensureDatabases = [ "vaultwarden" ];
+            ensureUsers = [
+              {
+                name = "vaultwarden";
+                ensureDBOwnership = true;
+              }
+            ];
+          };
+        };
+      };
+    };
+}