1{lib, ...}: {
 2  den.aspects.services.vaultwarden = {
 3    settings.host = {
 4      domain = lib.mkOption {
 5        type = lib.types.str;
 6      };
 7      address = lib.mkOption {
 8        type = lib.types.str;
 9        default = "127.0.0.1";
10      };
11      port = lib.mkOption {
12        type = lib.types.port;
13        default = 8222;
14      };
15    };
16
17    persist = {
18      directories = [
19        {
20          directory = "/var/lib/vaultwarden";
21          user = "vaultwarden";
22          group = "vaultwarden";
23          mode = "0700";
24        }
25      ];
26    };
27
28    reverseProxy = {host, ...}: let
29      cfg = host.settings.services.vaultwarden;
30    in {
31      ${cfg.domain} = {
32        port = cfg.port;
33      };
34    };
35
36    backup = {
37      pkgs,
38      lib,
39      ...
40    }: {
41      vaultwarden = let
42        backupDir = "/tmp/backups/vaultwarden";
43      in {
44        paths = [backupDir];
45
46        # See https://github.com/dani-garcia/vaultwarden/wiki/Backing-up-your-vault
47        backupPrepareCommand = lib.getExe (pkgs.writeShellApplication {
48          name = "backup-vaultwarden-prepare";
49          runtimeInputs = [
50            pkgs.sqlite
51          ];
52          text = ''
53            set -euo pipefail
54
55            DATA_DIR="/var/lib/vaultwarden"
56
57            mkdir -p "${backupDir}"
58
59            sqlite3 "$DATA_DIR/db.sqlite3" ".backup '${backupDir}/db.sqlite3'"
60
61            if [ -d "$DATA_DIR/attachments" ]; then
62              cp -a "$DATA_DIR/attachments" "${backupDir}/"
63            fi
64          '';
65        });
66        backupCleanupCommand = ''
67          rm -r "${backupDir}"
68        '';
69      };
70    };
71
72    nixos = {host, ...}: let
73      cfg = host.settings.services.vaultwarden;
74    in {
75      services.vaultwarden = {
76        enable = true;
77
78        inherit (cfg) domain;
79        dbBackend = "sqlite";
80        config = {
81          SIGNUPS_ALLOWED = false;
82          ENABLE_WEBSOCKET = true;
83          ROCKET_ADDRESS = cfg.address;
84          ROCKET_PORT = cfg.port;
85        };
86      };
87    };
88  };
89}