From e59274311259e4a26e106589ae7520e67a4d5e51 Mon Sep 17 00:00:00 2001
From: Rafael Oliveira <rmfseo@kth.se>
Date: Sat, 21 Sep 2024 17:23:25 +0200
Subject: [PATCH] add vaultwarden job on new host artemis

---
 .github/workflows/tofu-apply.yml |  3 +-
 .github/workflows/tofu-plan.yml  |  3 +-
 aws-ses.tf                       | 15 ++++++++
 hosts.tf                         |  1 +
 hosts/artemis.nix                | 22 +++++++++++
 jobs/vaultwarden.nomad.hcl       | 66 ++++++++++++++++++++++++++++++++
 modules/addresses.nix            |  1 +
 nomad.tf                         | 24 ++++++++++++
 profiles/traefik.nix             |  1 +
 9 files changed, 134 insertions(+), 2 deletions(-)
 create mode 100644 hosts/artemis.nix
 create mode 100644 jobs/vaultwarden.nomad.hcl

diff --git a/.github/workflows/tofu-apply.yml b/.github/workflows/tofu-apply.yml
index 8129360..80fc8a1 100644
--- a/.github/workflows/tofu-apply.yml
+++ b/.github/workflows/tofu-apply.yml
@@ -49,6 +49,7 @@ jobs:
         with:
             label: dsekt-infra
             variables: |
+              ssh_user = "${{ vars.TF_SSH_USER }}"
               hcloud_token = "${{ secrets.TF_HCLOUD_TOKEN }}"
               cloudflare_api_token = "${{ secrets.TF_CLOUDFLARE_TOKEN }}"
-              ssh_user = "${{ vars.TF_SSH_USER }}"
+              vault_db_password = "${{ secrets.TF_VAULT_DB_PASSWORD }}"
diff --git a/.github/workflows/tofu-plan.yml b/.github/workflows/tofu-plan.yml
index 375a70d..05c8f57 100644
--- a/.github/workflows/tofu-plan.yml
+++ b/.github/workflows/tofu-plan.yml
@@ -42,6 +42,7 @@ jobs:
         with:
           label: dsekt-infra
           variables: |
+            ssh_user = "${{ vars.TF_SSH_USER }}"
             hcloud_token = "${{ secrets.TF_HCLOUD_TOKEN }}"
             cloudflare_api_token = "${{ secrets.TF_CLOUDFLARE_TOKEN }}"
-            ssh_user = "${{ vars.TF_SSH_USER }}"
+            vault_db_password = "${{ secrets.TF_VAULT_DB_PASSWORD }}"
diff --git a/aws-ses.tf b/aws-ses.tf
index c424765..0f79de0 100644
--- a/aws-ses.tf
+++ b/aws-ses.tf
@@ -68,3 +68,18 @@ resource "aws_iam_user_policy_attachment" "mattermost_smtp" {
   user       = aws_iam_user.mattermost_smtp.name
   policy_arn = aws_iam_policy.send_email.arn
 }
+
+# Vaultwarden
+
+resource "aws_iam_user" "vaultwarden_smtp" {
+  name = "vaultwarden_smtp"
+}
+
+resource "aws_iam_access_key" "vaultwarden_smtp" {
+  user = aws_iam_user.vaultwarden_smtp.name
+}
+
+resource "aws_iam_user_policy_attachment" "vaultwarden_smtp" {
+  user       = aws_iam_user.vaultwarden_smtp.name
+  policy_arn = aws_iam_policy.send_email.arn
+}
diff --git a/hosts.tf b/hosts.tf
index a636b8a..2c95db7 100644
--- a/hosts.tf
+++ b/hosts.tf
@@ -5,6 +5,7 @@ locals {
     poseidon = { role = "server", private_ip_addr = "10.83.0.3", server_type = "cx22" }
     hades    = { role = "server", private_ip_addr = "10.83.0.4", server_type = "cx22" }
     ares     = { role = "client", private_ip_addr = "10.83.0.5", server_type = "cx21" }
+    artemis  = { role = "client", private_ip_addr = "10.83.0.6", server_type = "cx22" }
   }
 }
 
diff --git a/hosts/artemis.nix b/hosts/artemis.nix
new file mode 100644
index 0000000..1c0571f
--- /dev/null
+++ b/hosts/artemis.nix
@@ -0,0 +1,22 @@
+{ profiles, ... }:
+{
+  imports = with profiles; [
+    hetzner-cloud
+    base
+    nomad.client
+  ];
+
+  services.nomad.settings.client.host_volume = {
+    "vault/data" = {
+      path = "/var/lib/nomad-volumes/vault/data";
+    };
+  };
+
+  systemd.tmpfiles.rules = [
+    "d /var/lib/nomad-volumes 0500 0 0"
+    "d /var/lib/nomad-volumes/vault/data 0700 0 0" # vaultwarden runs as root
+  ];
+
+  # Change this if you want to lose all data on this machine!
+  system.stateVersion = "24.05";
+}
diff --git a/jobs/vaultwarden.nomad.hcl b/jobs/vaultwarden.nomad.hcl
new file mode 100644
index 0000000..baec2d9
--- /dev/null
+++ b/jobs/vaultwarden.nomad.hcl
@@ -0,0 +1,66 @@
+variable "domain_name" {
+  type    = string
+  default = "vault.datasektionen.se"
+}
+
+job "vault" {
+  namespace = "vault"
+
+  group "vault" {
+    network {
+      port "http" { }
+    }
+
+    service {
+      name     = "vault"
+      port     = "http"
+      provider = "nomad"
+      tags = [
+        "traefik.enable=true",
+        "traefik.http.routers.vault.rule=Host(`${var.domain_name}`)",
+        "traefik.http.routers.vault.tls.certresolver=default",
+      ]
+    }
+
+    volume "data" {
+      type = "host"
+      source = "vault/data"
+    }
+
+    task "vault" {
+      driver = "docker"
+
+      config {
+        image = "vaultwarden/server:1.32.0-alpine"
+        ports = ["http"]
+      }
+
+      template {
+        data = <<EOF
+DOMAIN=https://${var.domain_name}
+ROCKET_PORT={{ env "NOMAD_PORT_http" }}
+{{ with nomadVar "nomad/jobs/vault" }}
+DATABASE_URL=postgres://vaultwarden:{{ .db_password }}@postgres.dsekt.internal:5432/vaultwarden?sslmode=disable&connect_timeout=10
+SMTP_USERNAME={{ .smtp_username }}
+SMTP_PASSWORD={{ .smtp_password }}
+{{ end }}
+SMTP_HOST=email-smtp.eu-north-1.amazonaws.com
+SMTP_FROM=no-reply@datasektionen.se
+SMTP_FROM_NAME="Datasektionen Vault"
+SMTP_PORT=2465
+EOF
+        destination = "local/.env"
+        env = true
+      }
+
+      volume_mount {
+        volume = "data"
+        destination = "/data"
+      }
+
+      resources {
+        memory = 128 // MB
+      }
+    }
+  }
+}
diff --git a/modules/addresses.nix b/modules/addresses.nix
index 3b34c82..719d152 100644
--- a/modules/addresses.nix
+++ b/modules/addresses.nix
@@ -20,6 +20,7 @@ in
       poseidon = "10.83.0.3";
       hades = "10.83.0.4";
       ares = "10.83.0.5";
+      artemis = "10.83.0.6";
 
       self = self.${config.networking.hostName};
     });
diff --git a/nomad.tf b/nomad.tf
index 3f2680b..531d4b0 100644
--- a/nomad.tf
+++ b/nomad.tf
@@ -32,6 +32,30 @@ resource "nomad_job" "mattermost" {
   jobspec = file("${path.module}/jobs/mattermost.nomad.hcl")
 }
 
+# Vault
+
+variable "vault_db_password" {
+  sensitive = true
+}
+
+resource "nomad_namespace" "vault" {
+  name = "vault"
+}
+
+resource "nomad_job" "vault" {
+  jobspec = file("${path.module}/jobs/vaultwarden.nomad.hcl")
+}
+
+resource "nomad_variable" "jobs_vault" {
+  path = "nomad/jobs/vault"
+  namespace = "vault"
+  items = {
+    db_password = var.vault_db_password
+    smtp_username = aws_iam_access_key.vaultwarden_smtp.id
+    smtp_password = aws_iam_access_key.vaultwarden_smtp.ses_smtp_password_v4
+  }
+}
+
 # Auth
 
 resource "nomad_namespace" "auth" {
diff --git a/profiles/traefik.nix b/profiles/traefik.nix
index dde5c6a..5ad1250 100644
--- a/profiles/traefik.nix
+++ b/profiles/traefik.nix
@@ -46,6 +46,7 @@
           "default"
           "auth"
           "mattermost"
+          "vault"
         ];
       };