Vaultwarden: Difference between revisions
m fixed caddy syntax |
m fix nginx config typo Tags: Mobile edit Mobile web edit Visual edit |
||
| (7 intermediate revisions by 6 users not shown) | |||
| Line 2: | Line 2: | ||
== Example Configuration == | == Example Configuration == | ||
< | <syntaxhighlight lang="nix"> | ||
services.vaultwarden = { | services.vaultwarden = { | ||
enable = true; | enable = true; | ||
backupDir = "/var/lib/vaultwarden/ | backupDir = "/var/local/vaultwarden/backup"; | ||
# in order to avoid having ADMIN_TOKEN in the nix store it can be also set with the help of an environment file | |||
# be aware that this file must be created by hand (or via secrets management like sops) | |||
environmentFile = "/var/lib/vaultwarden/vaultwarden.env"; | |||
config = { | config = { | ||
# Refer to https://github.com/dani-garcia/vaultwarden/blob/main/.env.template | # Refer to https://github.com/dani-garcia/vaultwarden/blob/main/.env.template | ||
DOMAIN = "https://bitwarden.example.com"; | DOMAIN = "https://bitwarden.example.com"; | ||
SIGNUPS_ALLOWED = false; | SIGNUPS_ALLOWED = false; | ||
ROCKET_ADDRESS = "127.0.0.1"; | ROCKET_ADDRESS = "127.0.0.1"; | ||
ROCKET_PORT = 8222; | ROCKET_PORT = 8222; | ||
| Line 21: | Line 24: | ||
SMTP_HOST = "127.0.0.1"; | SMTP_HOST = "127.0.0.1"; | ||
SMTP_PORT = 25; | SMTP_PORT = 25; | ||
SMTP_SECURITY = off; | |||
SMTP_FROM = "admin@bitwarden.example.com"; | SMTP_FROM = "admin@bitwarden.example.com"; | ||
| Line 27: | Line 30: | ||
}; | }; | ||
}; | }; | ||
</ | </syntaxhighlight> | ||
== Reverse Proxy Setup (recommended) == | == Reverse Proxy Setup (recommended) == | ||
| Line 39: | Line 42: | ||
'';</syntaxhighlight> | '';</syntaxhighlight> | ||
=== Nginx === | === Nginx === | ||
< | <syntaxhighlight lang="nix"> | ||
services.nginx.virtualHosts."bitwarden.example.com" = { | services.nginx.virtualHosts."bitwarden.example.com" = { | ||
enableACME = true; | enableACME = true; | ||
| Line 45: | Line 48: | ||
locations."/" = { | locations."/" = { | ||
proxyPass = "http://127.0.0.1:${toString config.services.vaultwarden.config.ROCKET_PORT}"; | proxyPass = "http://127.0.0.1:${toString config.services.vaultwarden.config.ROCKET_PORT}"; | ||
proxyWebsockets = true; | |||
}; | }; | ||
}; | }; | ||
</syntaxhighlight> | |||
</ | |||
[[Category:Server]] | [[Category:Server]] | ||
[[Category:Security]] | [[Category:Security]] | ||
[[Category:Rust]] | |||