vaultwarden sso enable

hosts/artemis/default.nix

@@ -6,7 +6,18 @@
     ./macos.nix
   ];
   environment.systemPackages = with pkgs; [
-    vscodium 
+    (pkgs.vscodium.overrideAttrs (oldAttrs: {
+      postInstall = (oldAttrs.postInstall or "") + ''
+        substituteInPlace $out/Applications/VSCodium.app/Contents/Resources/app/product.json \
+          --replace '"extensionsGallery": {}' '"extensionsGallery": {
+            "serviceUrl": "https://visualstudio.com",
+            "cacheUrl": "https://windows.net",
+            "itemUrl": "https://visualstudio.com",
+            "controlUrl": "https://msecnd.net",
+            "recommendationsUrl": "https://visualstudio.com/recommendations"
+          }'
+      '';
+    }))
     git
   ];
 

modules/k3s/default.nix

@@ -66,16 +66,6 @@ in
         key = "token";
         sopsFile = "${inputs.secrets}/cluster/k3s.json";
       };
-      pg_pass = {
-        format = "json";
-        key = "pg-pass";
-        sopsFile = "${inputs.secrets}/cluster/authentik.json";
-      };
-      authentik_secret_key = {
-        format = "json";
-        key = "authentik-secret-key";
-        sopsFile = "${inputs.secrets}/cluster/authentik.json";
-      };
     };
     
     services.rpcbind.enable = true;

modules/k3s/deployments/vaultwarden.nix

@@ -29,6 +29,30 @@
                     containerPort = 80; 
                   }
                 ];
+                env = [
+                  { name = "DOMAIN"; value = "https://vault.nyxerinys.dev"; }
+                  { name = "SSO_ENABLED"; value = "true"; }
+                  { name = "SSO_AUTHORITY"; value = "https://authentik.company/application/o/vaultwarden/"; }
+                  { name = "SSO_SCOPES"; value = "email profile offline_access"; }
+                  { name = "SSO_ALLOW_UNKNOWN_EMAIL_VERIFICATION"; value = "false"; }
+                  { name = "SSO_CLIENT_CACHE_EXPIRATION"; value = "0"; }
+                  { name = "SSO_ONLY"; value = "true"; }
+                  { name = "SSO_SIGNUPS_MATCH_EMAIL"; value = "true"; }
+                  {
+                    name = "SSO_CLIENT_ID";
+                    valueFrom.secretKeyRef = {
+                      name = "vaultwarden-secrets";
+                      key = "sso_client_id";
+                    };
+                  }
+                  {
+                    name = "SSO_CLIENT_SECRET";
+                    valueFrom.secretKeyRef = {
+                      name = "vaultwarden-secrets";
+                      key = "sso_client_secret";
+                    };
+                  }
+                ];
                 volumeMounts = [
                   {
                     mountPath = "/data";

modules/k3s/secrets.nix

@@ -4,20 +4,58 @@ let
   cfg = config.nyxs-nix.services.k3s;
 in
 {
-  sops.templates = mkIf cfg.enable {
+  sops = mkIf cfg.enable {
-     "authentik-secrets.yaml" = {
+    secrets = {
-      content = ''
+      pg_pass = {
-        apiVersion: v1
+        format = "json";
-        kind: Secret
+        key = "pg-pass";
-        metadata:
+        sopsFile = "${inputs.secrets}/cluster/authentik.json";
-          name: authentik-secrets
+      };
-          namespace: default
+      authentik_secret_key = {
-        type: Opaque
+        format = "json";
-        stringData:
+        key = "authentik-secret-key";
-          pg_pass: ${config.sops.placeholder."pg_pass"}
+        sopsFile = "${inputs.secrets}/cluster/authentik.json";
-          authentik_secret_key: ${config.sops.placeholder."authentik_secret_key"}
+      };
-      '';
+      sso_client_id = {
-      path = "/var/lib/rancher/k3s/server/manifests/authentik-secrets.yaml";
+        format = "json";
-     };
+        key = "sso_client_id";
+        sopsFile = "${inputs.secrets}/cluster/vaultwarden.json";
+      };
+      sso_client_secret = {
+        format = "json";
+        key = "sso_client_secret";
+        sopsFile = "${inputs.secrets}/cluster/vaultwarden.json";
+      }
+    };
+    templates = {
+      "authentik-secrets.yaml" = {
+        content = ''
+          apiVersion: v1
+          kind: Secret
+          metadata:
+            name: authentik-secrets
+            namespace: default
+          type: Opaque
+          stringData:
+            pg_pass: ${config.sops.placeholder."pg_pass"}
+            authentik_secret_key: ${config.sops.placeholder."authentik_secret_key"}
+        '';
+        path = "/var/lib/rancher/k3s/server/manifests/authentik-secrets.yaml";
+      };
+      "vaultwarden-secrets.yaml" = {
+        content = ''
+          apiVersion: v1
+          kind: Secret
+          metadata:
+            name: vaultwarden-secrets
+            namespace: default
+          type: Opaque
+          stringData:
+            sso_client_id: ${config.sops.placeholder."sso_client_id"}
+            sso_client_secret: ${config.sops.placeholder."sso_client_secret"}
+        '';
+        path = "/var/lib/rancher/k3s/server/manifests/vaultwarden-secrets.yaml";
+      };
+    };
   };
 }