hosting/selfhostblocks
1
0
Fork 0
Code Issues Activity

haproxy reaching to hostname is wip

Browse source
This commit is contained in:
ibizaman 2023-01-22 09:02:46 -08:00
parent 6cbf1fc694
commit a8dfbe7154
1 changed files with 80 additions and 77 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

157
vaultwarden/default.nix
View file

@ -52,93 +52,93 @@ rec {
in { in {
inherit name; inherit name;
pkg = { pkg =
db { db
, web , web
}: let }: let
postgresHost = db.target.properties.hostname; postgresHost = db.target.properties.hostname;
in utils.systemd.mkService { in utils.systemd.mkService rec {
name = "vaultwarden"; name = "vaultwarden";
content = '' content = ''
[Unit] [Unit]
Description=Vaultwarden Server Description=Vaultwarden Server
Documentation=https://github.com/dani-garcia/vaultwarden Documentation=https://github.com/dani-garcia/vaultwarden
After=network.target After=network.target
After=${utils.keyServiceDependencies smtp.keys} After=${utils.keyServiceDependencies smtp.keys}
Wants=${utils.keyServiceDependencies smtp.keys} Wants=${utils.keyServiceDependencies smtp.keys}
[Service] [Service]
Environment=DATA_FOLDER=${dataFolder} Environment=DATA_FOLDER=${dataFolder}
Environment=DATABASE_URL=postgresql://${postgresUser}:${postgresPasswordLocation}@${postgresHost}/${postgresDatabase} Environment=DATABASE_URL=postgresql://${postgresUser}:${postgresPasswordLocation}@${postgresHost}/${postgresDatabase}
Environment=IP_HEADER=X-Real-IP Environment=IP_HEADER=X-Real-IP
Environment=WEB_VAULT_FOLDER=${web.path} Environment=WEB_VAULT_FOLDER=${web.path}
Environment=WEB_VAULT_ENABLED=${if webvaultEnabled then "true" else "false"} Environment=WEB_VAULT_ENABLED=${if webvaultEnabled then "true" else "false"}
Environment=SIGNUPS_ALLOWED=${if signupsAllowed then "true" else "false"} Environment=SIGNUPS_ALLOWED=${if signupsAllowed then "true" else "false"}
Environment=SIGNUPS_VERIFY=${if signupsVerify then "true" else "false"} Environment=SIGNUPS_VERIFY=${if signupsVerify then "true" else "false"}
# Disabled because the /admin path is protected by SSO # Disabled because the /admin path is protected by SSO
Environment=DISABLE_ADMIN_TOKEN=true Environment=DISABLE_ADMIN_TOKEN=true
Environment=INVITATIONS_ALLOWED=true Environment=INVITATIONS_ALLOWED=true
Environment=DOMAIN=https://${subdomain}.${domain} Environment=DOMAIN=https://${subdomain}.${domain}
# Assumes we're behind a reverse proxy # Assumes we're behind a reverse proxy
Environment=ROCKET_ADDRESS=127.0.0.1 Environment=ROCKET_ADDRESS=127.0.0.1
Environment=ROCKET_PORT=${builtins.toString ingress} Environment=ROCKET_PORT=${builtins.toString ingress}
Environment=USE_SYSLOG=true Environment=USE_SYSLOG=true
Environment=EXTENDED_LOGGING=true Environment=EXTENDED_LOGGING=true
Environment=LOG_FILE= Environment=LOG_FILE=
Environment=LOG_LEVEL=trace Environment=LOG_LEVEL=trace
${utils.keyEnvironmentFiles smtp.keys} ${utils.keyEnvironmentFiles smtp.keys}
Environment=SMTP_FROM=${smtp.from} Environment=SMTP_FROM=${smtp.from}
Environment=SMTP_FROM_NAME=${smtp.fromName} Environment=SMTP_FROM_NAME=${smtp.fromName}
Environment=SMTP_PORT=${builtins.toString smtp.port} Environment=SMTP_PORT=${builtins.toString smtp.port}
Environment=SMTP_AUTH_MECHANISM=${smtp.authMechanism} Environment=SMTP_AUTH_MECHANISM=${smtp.authMechanism}
ExecStart=${pkgs.vaultwarden-postgresql}/bin/vaultwarden ExecStart=${pkgs.vaultwarden-postgresql}/bin/vaultwarden
WorkingDirectory=${dataFolder} WorkingDirectory=${dataFolder}
StateDirectory=${name} StateDirectory=${name}
User=${user} User=${user}
Group=${group} Group=${group}
# Allow vaultwarden to bind ports in the range of 0-1024 and restrict it to # Allow vaultwarden to bind ports in the range of 0-1024 and restrict it to
# that capability # that capability
CapabilityBoundingSet=${if ingress <= 1024 then "CAP_NET_BIND_SERVICE" else ""} CapabilityBoundingSet=${if ingress <= 1024 then "CAP_NET_BIND_SERVICE" else ""}
AmbientCapabilities=${if ingress <= 1024 then "CAP_NET_BIND_SERVICE" else ""} AmbientCapabilities=${if ingress <= 1024 then "CAP_NET_BIND_SERVICE" else ""}
PrivateUsers=yes PrivateUsers=yes
NoNewPrivileges=yes NoNewPrivileges=yes
LimitNOFILE=1048576 LimitNOFILE=1048576
UMask=0077 UMask=0077
ProtectSystem=strict ProtectSystem=strict
ProtectHome=yes ProtectHome=yes
# ReadWritePaths=${dataFolder} # ReadWritePaths=${dataFolder}
PrivateTmp=yes PrivateTmp=yes
PrivateDevices=yes PrivateDevices=yes
ProtectHostname=yes ProtectHostname=yes
ProtectClock=yes ProtectClock=yes
ProtectKernelTunables=yes ProtectKernelTunables=yes
ProtectKernelModules=yes ProtectKernelModules=yes
ProtectKernelLogs=yes ProtectKernelLogs=yes
ProtectControlGroups=yes ProtectControlGroups=yes
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
RestrictNamespaces=yes RestrictNamespaces=yes
LockPersonality=yes LockPersonality=yes
MemoryDenyWriteExecute=yes MemoryDenyWriteExecute=yes
RestrictRealtime=yes RestrictRealtime=yes
RestrictSUIDSGID=yes RestrictSUIDSGID=yes
RemoveIPC=yes RemoveIPC=yes
SystemCallFilter=@system-service SystemCallFilter=@system-service
SystemCallFilter=~@privileged @resources SystemCallFilter=~@privileged @resources
SystemCallArchitectures=native SystemCallArchitectures=native
[Install] [Install]
WantedBy=multi-user.target WantedBy=multi-user.target
''; '';
}; };
dependsOn = { dependsOn = {
inherit db; inherit db;
@ -157,8 +157,11 @@ rec {
backend = { backend = {
# TODO: instead, we should generate target specific service https://hydra.nixos.org/build/203347995/download/2/manual/#idm140737322273072 # TODO: instead, we should generate target specific service https://hydra.nixos.org/build/203347995/download/2/manual/#idm140737322273072
servers = map (dist: { servers = map (dist: {
name = "ttrss_${dist.properties.hostname}_1"; name = "vaultwarden_${dist.properties.hostname}_1";
address = "${dist.properties.hostname}:${builtins.toString ingress}"; # TODO: should use the hostname
# address = "${dist.properties.hostname}:${builtins.toString ingress}";
address = "127.0.0.1:${builtins.toString ingress}";
resolvers = "default";
}) service; }) service;
}; };
}; };