Add vaultwarden.

machines/lebesgue/config/configuration.nix

@@ -4,15 +4,18 @@
   pkgs,
   ...
 }: {
-  imports = [
-    ./hardware-configuration.nix
-  ];
-
   foehammer = {
     users.admin = {
       enable = true;
       hashedPasswordFile = config.sops.secrets.admin-password.path;
     };
+
+    services.vaultwarden = {
+      enable = true;
+      domain = "https://passwords.foehammer.me";
+      signups = false;
+      envPath = config.sops.secrets.vaultwarden-env.path;
+    };
   };
 
   services.tailscale = {

machines/lebesgue/config/routing.nix

@@ -0,0 +1,13 @@
+{config, ...}: {
+  foehammer.caddy.enable = true;
+
+  services.caddy = {
+    virtualHosts = {
+      "passwords.foehammer.me" = {
+        extraConfig = ''
+          reverse_proxy :${toString config.foehammer.services.vaultwarden.port}
+        '';
+      };
+    };
+  };
+}

machines/lebesgue/config/secrets.nix

@@ -5,6 +5,7 @@
     secrets = {
       admin-password.neededForUsers = true;
       tskey = {};
+      vaultwarden-env = {};
     };
   };
 }

machines/lebesgue/config/state.nix

@@ -8,6 +8,7 @@
         "/var/log"
         "/var/lib/nixos"
         "/var/lib/docker"
+        "/var/lib/caddy/.local/share/caddy"
       ]
       ++ config.foehammer.backups.paths;