services: vaultwarden: add initial service configuration

Signed-off-by: Christoph Heiss <christoph@c8h4.io>

machines/tank.nix

@@ -16,6 +16,7 @@
     ../services/postgresql.nix
     ../services/prometheus.nix
     ../services/sourcehut.nix
+    ../services/vaultwarden.nix
     ../system/baremetal-server.nix
     ../system/ucode-amd.nix
     ../system/zfs.nix

services/vaultwarden.nix

@@ -0,0 +1,31 @@
+{ lib, my, secrets, ... }:
+
+{
+  services.vaultwarden = {
+    enable = true;
+    environmentFile = secrets.vaultwarden-env.destination;
+    dbBackend = "postgresql";
+    config = {
+      DOMAIN = "https://vaultwarden.${my.domain}";
+      DATA_FOLDER = "/var/lib/vaultwarden";
+      DATABASE_URL = "postgresql:///vaultwarden";
+      SIGNUPS_ALLOWED = false;
+      INVITATIONS_ALLOWED = false;
+      SHOW_PASSWORD_HINT = false;
+      ROCKET_ADDRESS = "::1";
+      ROCKET_PORT = 8222;
+    };
+  };
+
+  systemd.services.vaultwarden.serviceConfig.StateDirectory =
+    lib.mkForce "vaultwarden";
+
+  services.postgresql = {
+    ensureDatabases = [ "vaultwarden" ];
+    ensureUsers = [{
+      name = "vaultwarden";
+      ensureDBOwnership = true;
+      ensureClauses.login = true;
+    }];
+  };
+}