yadunut/clan-core
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Merge pull request 'clanModules/vaultwarden: Migrate from facts to vars' (#3394) from kenji/clan-core:ke-vaultwarden-migrate-to-vars into main

Browse Source 
Reviewed-on: https://git.clan.lol/clan/clan-core/pulls/3394
This commit is contained in:
Mic92
2025-04-23 11:32:52 +00:00
parent 55e1141eb3 47073aed43
commit 8bc58b1f8c
2 changed files with 20 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
clanModules/vaultwarden/README.md
View File

@@ -6,9 +6,10 @@ After enabling the clan module, user accounts have to be created manually in the
This is done by visiting `vaultwarden.example.com/admin` and typing in the admin password. This is done by visiting `vaultwarden.example.com/admin` and typing in the admin password.
You can get the admin password for vaultwarden by executing: You can get the admin password for vaultwarden by executing:
```bash ```bash
clan secrets get <machine-name>-vaultwarden-admin clan vars get <machine-name> vaultwarden-admin/vaultwarden-admin
``` ```
To see all secrets tied to vaultwarden execute: To see all secrets tied to vaultwarden execute:
```bash ```bash
clan secrets list | grep vaultwarden clan vars get vaultwarden-admin/vaultwarden-admin
clan vars get vaultwarden-smtp/vaultwarden-smtp
``` ```

31
clanModules/vaultwarden/default.nix
View File

@@ -92,36 +92,39 @@ in
}; };
}; };
clan.core.facts.services = { clan.core.vars.generators = {
vaultwarden-admin = { vaultwarden-admin = {
secret."vaultwarden-admin" = { }; migrateFact = "vaultwarden-admin";
secret."vaultwarden-admin-hash" = { }; files."vaultwarden-admin" = { };
generator.path = with pkgs; [ files."vaultwarden-admin-hash" = { };
runtimeInputs = with pkgs; [
coreutils coreutils
pwgen pwgen
libargon2 libargon2
openssl openssl
]; ];
generator.script = '' script = ''
ADMIN_PWD=$(pwgen 16 -n1 | tr -d "\n") ADMIN_PWD=$(pwgen 16 -n1 | tr -d "\n")
ADMIN_HASH=$(echo -n "$ADMIN_PWD" | argon2 "$(openssl rand -base64 32)" -e -id -k 65540 -t 3 -p 4) ADMIN_HASH=$(echo -n "$ADMIN_PWD" | argon2 "$(openssl rand -base64 32)" -e -id -k 65540 -t 3 -p 4)
config=" config="
ADMIN_TOKEN=\"$ADMIN_HASH\" ADMIN_TOKEN=\"$ADMIN_HASH\"
" "
echo -n "$ADMIN_PWD" > "$secrets"/vaultwarden-admin echo -n "$ADMIN_PWD" > "$out"/vaultwarden-admin
echo -n "$config" > "$secrets"/vaultwarden-admin-hash echo -n "$config" > "$out"/vaultwarden-admin-hash
''; '';
}; };
vaultwarden-smtp = { vaultwarden-smtp = {
secret."vaultwarden-smtp" = { }; migrateFact = "vaultwarden-smtp";
generator.prompt = "${cfg.smtp.from} SMTP password"; prompts."vaultwarden-smtp".description = "${cfg.smtp.from} SMTP password";
generator.path = with pkgs; [ coreutils ]; prompts."vaultwarden-smtp".persist = true;
generator.script = '' runtimeInputs = with pkgs; [ coreutils ];
script = ''
prompt_value="$(cat "$prompts"/vaultwarden-smtp)"
config=" config="
SMTP_PASSWORD=\"$prompt_value\" SMTP_PASSWORD=\"$prompt_value\"
" "
echo -n "$config" > "$secrets"/vaultwarden-smtp echo -n "$config" > "$out"/vaultwarden-smtp
''; '';
}; };
}; };
@@ -129,7 +132,7 @@ in
systemd.services."vaultwarden" = { systemd.services."vaultwarden" = {
serviceConfig = { serviceConfig = {
EnvironmentFile = [ EnvironmentFile = [
config.clan.core.facts.services."vaultwarden-smtp".secret."vaultwarden-smtp".path config.clan.core.vars.generators."vaultwarden-smtp".files."vaultwarden-smtp".path
]; ];
}; };
}; };
@@ -138,7 +141,7 @@ in
enable = true; enable = true;
dbBackend = "postgresql"; dbBackend = "postgresql";
environmentFile = environmentFile =
config.clan.core.facts.services."vaultwarden-admin".secret."vaultwarden-admin-hash".path; # TODO: Make this upstream an array config.clan.core.vars.generators."vaultwarden-admin".files."vaultwarden-admin-hash".path; # TODO: Make this upstream an array
config = { config = {
SMTP_SECURITY = "force_tls"; SMTP_SECURITY = "force_tls";
SMTP_HOST = cfg.smtp.host; SMTP_HOST = cfg.smtp.host;