+vaultwarden

hosts/AZ-CLD-1/services/default.nix

@@ -5,5 +5,6 @@
     ./outline.nix
     ./postgres.nix
     ./traefik.nix
+    ./vaultwarden.nix
   ];
 }

hosts/AZ-CLD-1/services/vaultwarden.nix

@@ -0,0 +1,30 @@
+{config, ...}: {
+  services.vaultwarden = {
+    enable = true;
+    backupDir = "/var/backup/vaultwarden";
+    config = {
+      ROCKET_ADDRESS = "127.0.0.1";
+      ROCKET_PORT = 3032;
+    };
+    environmentFile = "${config.age.secrets.vaultwarden-env.path}";
+  };
+
+  # Traefik configuration for headscale
+  services.traefik.dynamicConfigOptions.http = {
+    services.vaultwarden.loadBalancer.servers = [
+      {
+        url = "http://localhost:3032/";
+      }
+    ];
+
+    routers.vaultwarden = {
+      rule = "Host(`pw.az-gruppe.com`)";
+      tls = {
+        certResolver = "ionos";
+      };
+      service = "vaultwarden";
+      entrypoints = "websecure";
+    };
+  };
+}
+