feat(vaultwarden): enabled sso

machines/bomba/secrets.nix

@@ -25,6 +25,7 @@
         navidrome_env = default;
         yamtrack_env = default;
         authentik_env = default;
+        vaultwarden_env = default;
       };
     };
 }

machines/bomba/services/caddy.nix

@@ -34,7 +34,7 @@
         '';
         "vaultwarden.patrickcanal.it".extraConfig = ''
           encode zstd gzip
-          reverse_proxy :${toString config.services.vaultwarden.config.ROCKET_PORT} {
+          reverse_proxy :8003 {
             header_up X-Real-IP {remote_host}
           }
         '';

machines/bomba/services/vaultwarden.nix

@@ -1,11 +1,26 @@
-{ ... }:
+{ config, ... }:
 {
   services.vaultwarden = {
     enable = true;
-    config = {
-      DOMAIN = "https://vaultwarden.patrickcanal.it";
-      ROCKET_ADDRESS = "127.0.0.1";
-      ROCKET_PORT = 8003;
-    };
+    environmentFile = config.sops.secrets.vaultwarden_env.path;
+    # config = {
+    #   DOMAIN = "https://vaultwarden.patrickcanal.it";
+    #   ROCKET_ADDRESS = "127.0.0.1";
+    #   ROCKET_PORT = 8003;
+    #   SSO_ENABLED = true;
+    #   SSO_ONLY = false;
+    #   SSO_AUTHORITY = "https://auth.patrickcanal.it";
+    #   SSO_SCOPES = [
+    #     "profile"
+    #     "email"
+    #     "offline_access"
+    #     "vaultwarden"
+    #   ];
+    #   SSO_PKCE = true;
+    #   SSO_CLIENT_ID = "vaultwarden";
+    #   SSO_CLIENT_SECRET = config.sops.secrets.vaultwarden_sso_secret;
+    #   SSO_ROLES_ENABLED = true;
+    #   SSO_ROLES_DEFAULT_TO_USER = true;
+    # };
   };
 }