vaultwarden sso enable

hosts/artemis/default.nix

@@ -6,7 +6,18 @@
     ./macos.nix
   ];
   environment.systemPackages = with pkgs; [
-    vscodium 
+    (pkgs.vscodium.overrideAttrs (oldAttrs: {
+      postInstall = (oldAttrs.postInstall or "") + ''
+        substituteInPlace $out/Applications/VSCodium.app/Contents/Resources/app/product.json \
+          --replace '"extensionsGallery": {}' '"extensionsGallery": {
+            "serviceUrl": "https://visualstudio.com",
+            "cacheUrl": "https://windows.net",
+            "itemUrl": "https://visualstudio.com",
+            "controlUrl": "https://msecnd.net",
+            "recommendationsUrl": "https://visualstudio.com/recommendations"
+          }'
+      '';
+    }))
     git
   ];
 

hosts/artemis/homebrew.nix

@@ -39,15 +39,16 @@
   homebrew = {
     enable = true;
     onActivation.cleanup = "zap"; # Cleans packages not defined here
-
-    # Use Mac Casks instead of standard Nix packages for GUI apps
+    enableZshIntegration = true;
+    brews = [
+      "python@3.14"
+    ];
     casks = [
       "steam"
       "discord"
       "discord@canary"
       "Sikarugir-App/sikarugir/sikarugir"
       "zen"
-      "python"
     ];
   };
 }

modules/k3s/default.nix

@@ -66,16 +66,6 @@ in
         key = "token";
         sopsFile = "${inputs.secrets}/cluster/k3s.json";
       };
-      pg_pass = {
-        format = "json";
-        key = "pg-pass";
-        sopsFile = "${inputs.secrets}/cluster/authentik.json";
-      };
-      authentik_secret_key = {
-        format = "json";
-        key = "authentik-secret-key";
-        sopsFile = "${inputs.secrets}/cluster/authentik.json";
-      };
     };
     
     services.rpcbind.enable = true;

modules/k3s/deployments/vaultwarden.nix

@@ -29,6 +29,30 @@
                     containerPort = 80; 
                   }
                 ];
+                env = [
+                  { name = "DOMAIN"; value = "https://vault.nyxerinys.dev"; }
+                  { name = "SSO_ENABLED"; value = "true"; }
+                  { name = "SSO_AUTHORITY"; value = "https://authentik.company/application/o/vaultwarden/"; }
+                  { name = "SSO_SCOPES"; value = "email profile offline_access"; }
+                  { name = "SSO_ALLOW_UNKNOWN_EMAIL_VERIFICATION"; value = "false"; }
+                  { name = "SSO_CLIENT_CACHE_EXPIRATION"; value = "0"; }
+                  { name = "SSO_ONLY"; value = "true"; }
+                  { name = "SSO_SIGNUPS_MATCH_EMAIL"; value = "true"; }
+                  {
+                    name = "SSO_CLIENT_ID";
+                    valueFrom.secretKeyRef = {
+                      name = "vaultwarden-secrets";
+                      key = "sso_client_id";
+                    };
+                  }
+                  {
+                    name = "SSO_CLIENT_SECRET";
+                    valueFrom.secretKeyRef = {
+                      name = "vaultwarden-secrets";
+                      key = "sso_client_secret";
+                    };
+                  }
+                ];
                 volumeMounts = [
                   {
                     mountPath = "/data";

modules/k3s/secrets.nix

@@ -4,7 +4,30 @@ let
   cfg = config.nyxs-nix.services.k3s;
 in
 {
-  sops.templates = mkIf cfg.enable {
+  sops = mkIf cfg.enable {
+    secrets = {
+      pg_pass = {
+        format = "json";
+        key = "pg-pass";
+        sopsFile = "${inputs.secrets}/cluster/authentik.json";
+      };
+      authentik_secret_key = {
+        format = "json";
+        key = "authentik-secret-key";
+        sopsFile = "${inputs.secrets}/cluster/authentik.json";
+      };
+      sso_client_id = {
+        format = "json";
+        key = "sso_client_id";
+        sopsFile = "${inputs.secrets}/cluster/vaultwarden.json";
+      };
+      sso_client_secret = {
+        format = "json";
+        key = "sso_client_secret";
+        sopsFile = "${inputs.secrets}/cluster/vaultwarden.json";
+      }
+    };
+    templates = {
       "authentik-secrets.yaml" = {
         content = ''
           apiVersion: v1
@@ -19,5 +42,20 @@ in
         '';
         path = "/var/lib/rancher/k3s/server/manifests/authentik-secrets.yaml";
       };
+      "vaultwarden-secrets.yaml" = {
+        content = ''
+          apiVersion: v1
+          kind: Secret
+          metadata:
+            name: vaultwarden-secrets
+            namespace: default
+          type: Opaque
+          stringData:
+            sso_client_id: ${config.sops.placeholder."sso_client_id"}
+            sso_client_secret: ${config.sops.placeholder."sso_client_secret"}
+        '';
+        path = "/var/lib/rancher/k3s/server/manifests/vaultwarden-secrets.yaml";
+      };
+    };
   };
 }