Vaultwarden

Open source password manager. https://github.com/dani-garcia/vaultwarden

Prerequisites

Vaultwarden needs a properly configured SMTP server to complete a user registration.

Usage

momo-cloud.vaultwarden = {
  enable = true;
  oidcSecretFile = config.age.secrets."vaultwarden-oidc-secret".path;
  envFile = config.age.secrets."vaultwarden-secrets-env".path;
};

The secrets in the env file that need to be set are SSO_CLIENT_SECRET and SMTP_PASSWORD.

Example:

SSO_CLIENT_SECRET="secret"
SMTP_PASSWORD="password"

There are two kanidm groups for using vaultwarden:

1. vaultwarden_admins: grants admin rights (not implemented)
2. vaultwarden_users: allows users to access the application

Secrets

To generate the OIDC secret for oidcSecretFile, used by services.kanidm.provision, you can use xxd:

xxd -u -l 32 -p /dev/urandom