add vaultwarden job on new host artemis

.github/workflows/tofu-apply.yml

@@ -49,6 +49,7 @@ jobs:
         with:
             label: dsekt-infra
             variables: |
+              ssh_user = "${{ vars.TF_SSH_USER }}"
               hcloud_token = "${{ secrets.TF_HCLOUD_TOKEN }}"
               cloudflare_api_token = "${{ secrets.TF_CLOUDFLARE_TOKEN }}"
-              ssh_user = "${{ vars.TF_SSH_USER }}"
+              vault_db_password = "${{ secrets.TF_VAULT_DB_PASSWORD }}"

.github/workflows/tofu-plan.yml

@@ -42,6 +42,7 @@ jobs:
         with:
           label: dsekt-infra
           variables: |
+            ssh_user = "${{ vars.TF_SSH_USER }}"
             hcloud_token = "${{ secrets.TF_HCLOUD_TOKEN }}"
             cloudflare_api_token = "${{ secrets.TF_CLOUDFLARE_TOKEN }}"
-            ssh_user = "${{ vars.TF_SSH_USER }}"
+            vault_db_password = "${{ secrets.TF_VAULT_DB_PASSWORD }}"

aws-ses.tf

@@ -68,3 +68,18 @@ resource "aws_iam_user_policy_attachment" "mattermost_smtp" {
   user       = aws_iam_user.mattermost_smtp.name
   policy_arn = aws_iam_policy.send_email.arn
 }
+
+# Vaultwarden
+
+resource "aws_iam_user" "vaultwarden_smtp" {
+  name = "vaultwarden_smtp"
+}
+
+resource "aws_iam_access_key" "vaultwarden_smtp" {
+  user = aws_iam_user.vaultwarden_smtp.name
+}
+
+resource "aws_iam_user_policy_attachment" "vaultwarden_smtp" {
+  user       = aws_iam_user.vaultwarden_smtp.name
+  policy_arn = aws_iam_policy.send_email.arn
+}

hosts.tf

@@ -5,6 +5,7 @@ locals {
     poseidon = { role = "server", private_ip_addr = "10.83.0.3", server_type = "cx22" }
     hades    = { role = "server", private_ip_addr = "10.83.0.4", server_type = "cx22" }
     ares     = { role = "client", private_ip_addr = "10.83.0.5", server_type = "cx21" }
+    artemis  = { role = "client", private_ip_addr = "10.83.0.6", server_type = "cx22" }
   }
 }
 

hosts/artemis.nix

@@ -0,0 +1,22 @@
+{ profiles, ... }:
+{
+  imports = with profiles; [
+    hetzner-cloud
+    base
+    nomad.client
+  ];
+
+  services.nomad.settings.client.host_volume = {
+    "vault/data" = {
+      path = "/var/lib/nomad-volumes/vault/data";
+    };
+  };
+
+  systemd.tmpfiles.rules = [
+    "d /var/lib/nomad-volumes 0500 0 0"
+    "d /var/lib/nomad-volumes/vault/data 0700 0 0" # vaultwarden runs as root
+  ];
+
+  # Change this if you want to lose all data on this machine!
+  system.stateVersion = "24.05";
+}

jobs/vaultwarden.nomad.hcl

@@ -0,0 +1,66 @@
+variable "domain_name" {
+  type    = string
+  default = "vault.datasektionen.se"
+}
+
+job "vault" {
+  namespace = "vault"
+
+  group "vault" {
+    network {
+      port "http" { }
+    }
+
+    service {
+      name     = "vault"
+      port     = "http"
+      provider = "nomad"
+      tags = [
+        "traefik.enable=true",
+        "traefik.http.routers.vault.rule=Host(`${var.domain_name}`)",
+        "traefik.http.routers.vault.tls.certresolver=default",
+      ]
+    }
+
+    volume "data" {
+      type = "host"
+      source = "vault/data"
+    }
+
+    task "vault" {
+      driver = "docker"
+
+      config {
+        image = "vaultwarden/server:1.32.0-alpine"
+        ports = ["http"]
+      }
+
+      template {
+        data = <<EOF
+DOMAIN=https://${var.domain_name}
+ROCKET_PORT={{ env "NOMAD_PORT_http" }}
+{{ with nomadVar "nomad/jobs/vault" }}
+DATABASE_URL=postgres://vaultwarden:{{ .database_password }}@postgres.dsekt.internal:5432/vaultwarden?sslmode=disable&connect_timeout=10
+SMTP_USERNAME={{ .smtp_username }}
+SMTP_PASSWORD={{ .smtp_password }}
+{{ end }}
+SMTP_HOST=email-smtp.eu-north-1.amazonaws.com
+[email protected]
+SMTP_FROM_NAME="Datasektionen Vault"
+SMTP_PORT=2465
+EOF
+        destination = "local/.env"
+        env = true
+      }
+
+      volume_mount {
+        volume = "data"
+        destination = "/data"
+      }
+
+      resources {
+        memory = 128 // MB
+      }
+    }
+  }
+}

modules/addresses.nix

@@ -20,6 +20,7 @@ in
       poseidon = "10.83.0.3";
       hades = "10.83.0.4";
       ares = "10.83.0.5";
+      artemis = "10.83.0.6";
 
       self = self.${config.networking.hostName};
     });

nomad.tf

@@ -32,6 +32,29 @@ resource "nomad_job" "mattermost" {
   jobspec = file("${path.module}/jobs/mattermost.nomad.hcl")
 }
 
+# Vault
+
+variable "vault_db_password" {
+  sensitive = true
+}
+
+resource "nomad_namespace" "vault" {
+  name = "vault"
+}
+
+resource "nomad_job" "vault" {
+  jobspec = file("${path.module}/jobs/vaultwarden.nomad.hcl")
+}
+
+resource "nomad_variable" "jobs_vault" {
+  path = "nomad/jobs/vault"
+  items = {
+    db_password = var.vault_db_password
+    smtp_username = aws_iam_access_key.vaultwarden_smtp.id
+    smtp_password = aws_iam_access_key.vaultwarden_smtp.ses_smtp_password_v4
+  }
+}
+
 # Auth
 
 resource "nomad_namespace" "auth" {

profiles/traefik.nix

@@ -46,6 +46,7 @@
           "default"
           "auth"
           "mattermost"
+          "vault"
         ];
       };