feat: add vaultwarden module

modules/hosts/alpha/config.nix

@@ -55,6 +55,12 @@
 
             environmentFile = innerArgs.config.sops.secrets."mediaflow-proxy".path;
           };
+
+          vaultwarden = {
+            enable = true;
+            port = 9999;
+            domain = "bw.lab.tux.rs";
+          };
         };
 
         virtualisation = {

modules/nixos/services/vaultwarden.nix

@@ -0,0 +1,68 @@
+{
+  flake.modules.nixos.services =
+    {
+      config,
+      lib,
+      ...
+    }:
+    with lib;
+    let
+      cfg = config.tnix.services.vaultwarden;
+    in
+    {
+      options.tnix.services.vaultwarden = {
+        enable = mkEnableOption "Enable Vaultwarden";
+
+        port = mkOption {
+          type = types.int;
+          default = 8000;
+        };
+
+        domain = mkOption {
+          type = types.str;
+          default = "";
+        };
+      };
+
+      config = mkIf cfg.enable {
+        services = {
+          vaultwarden = {
+            enable = true;
+            dbBackend = "postgresql";
+            config = {
+              ROCKET_ADDRESS = "127.0.0.1";
+              ROCKET_PORT = cfg.port;
+              DOMAIN = "https://${cfg.domain}";
+
+              DATABASE_URL = "postgresql:///vaultwarden?host=/run/postgresql";
+              ENABLE_WEBSOCKET = true;
+              SIGNUPS_ALLOWED = true;
+              DISABLE_ICON_DOWNLOAD = true;
+            };
+          };
+
+          nginx.virtualHosts.${cfg.domain} = {
+            forceSSL = true;
+            useACMEHost = "lab.tux.rs";
+            locations = {
+              "/" = {
+                proxyPass = "http://localhost:${toString cfg.port}";
+                proxyWebsockets = true;
+              };
+            };
+          };
+
+          postgresql = {
+            enable = true;
+            ensureDatabases = [ "vaultwarden" ];
+            ensureUsers = [
+              {
+                name = "vaultwarden";
+                ensureDBOwnership = true;
+              }
+            ];
+          };
+        };
+      };
+    };
+}