feat: add config files

Makefile

@@ -73,11 +73,10 @@ install:  ## Install files into rpm dest (requires env var DESTDIR)
 		printf "[CRITICAL] Missing env var DESTDIR\n[CRITICAL] This command is designed to be called by rpmbuild only!\n" 1>&2; \
 		exit 1; \
 	fi
-	install --mode=755 --directory $(DESTDIR)$(RPM_SYSCONFDIR)/nginx/conf.d $(DESTDIR)$(RPM_SYSCONFDIR)/certbot $(DESTDIR)$(RPM_UNITDIR) $(DESTDIR)$(RPM_SBINDIR)
+	install --mode=755 --directory $(DESTDIR)$(RPM_SYSCONFDIR)/nginx/conf.d $(DESTDIR)$(RPM_SYSCONFDIR)/vaultwarden $(DESTDIR)$(RPM_UNITDIR)/vaultwarden.service.d
-	install --mode=644 --target-directory=$(DESTDIR)$(RPM_SYSCONFDIR)/nginx/conf.d files/nginx/0_security.conf files/nginx/z_default.conf
+	install --mode=644 --target-directory=$(DESTDIR)$(RPM_SYSCONFDIR)/nginx/conf.d files/nginx/vault.netoik.io.conf
-	install --mode=600 --target-directory=$(DESTDIR)$(RPM_SYSCONFDIR)/certbot files/certbot/ovh.ini
+	install --mode=640 --target-directory=$(DESTDIR)$(RPM_SYSCONFDIR)/vaultwarden files/vaultwarden/netoik_vaultwarden.cfg
-	install --mode=644 --target-directory=$(DESTDIR)$(RPM_UNITDIR) files/systemd/certbot-renew.service files/systemd/certbot-renew.timer
+	install --mode=644 --target-directory=$(DESTDIR)$(RPM_UNITDIR)/vaultwarden.service.d files/systemd/vaultwarden.conf
-	install --mode=755 --target-directory=$(DESTDIR)$(RPM_SBINDIR) files/sbin/certbot_renew
 
 .PHONY: upload
 upload:  ## Upload rpm package to Gitea repository (requires env var PKG_TOKEN)

files/nginx/vault.netoik.io.conf

@@ -0,0 +1,8 @@
+server {
+    listen       443 ssl;
+    server_name  vault.netoik.io;
+
+    location / {
+        proxy_pass http://127.0.0.1:8000;
+    }
+}

files/systemd/vaultwarden.conf

@@ -0,0 +1,3 @@
+[Service]
+Environment=
+Environment="ENV_FILE=/etc/vaultwarden/netoik_vaultwarden.cfg"

files/vaultwarden/netoik_vaultwarden.cfg

@@ -0,0 +1,52 @@
+####################
+### Data folders ###
+####################
+
+## Main data folder
+DATA_FOLDER=/var/lib/vaultwarden
+
+## Web vault settings
+WEB_VAULT_FOLDER=/usr/share/vaultwarden-web
+WEB_VAULT_ENABLED=true
+
+
+#########################
+### Database settings ###
+#########################
+
+## Database URL
+## When using SQLite, this is the path to the DB file, default to %DATA_FOLDER%/db.sqlite3
+# DATABASE_URL=data/db.sqlite3
+## When using MySQL, specify an appropriate connection URI.
+## Details: https://docs.diesel.rs/2.1.x/diesel/mysql/struct.MysqlConnection.html
+# DATABASE_URL=mysql://user:password@host[:port]/database_name
+## When using PostgreSQL, specify an appropriate connection URI (recommended)
+## or keyword/value connection string.
+## Details:
+## - https://docs.diesel.rs/2.1.x/diesel/pg/struct.PgConnection.html
+## - https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-CONNSTRING
+DATABASE_URL=postgresql:///
+
+
+########################
+### General settings ###
+########################
+
+## Domain settings
+## The domain must match the address from where you access the server
+## It's recommended to configure this value, otherwise certain functionality might not work,
+## like attachment downloads, email links and U2F.
+## For U2F to work, the server must use HTTPS, you can use Let's Encrypt for free certs
+## To use HTTPS, the recommended way is to put Vaultwarden behind a reverse proxy
+## Details:
+## - https://github.com/dani-garcia/vaultwarden/wiki/Enabling-HTTPS
+## - https://github.com/dani-garcia/vaultwarden/wiki/Proxy-examples
+## For development
+# DOMAIN=http://localhost
+## For public server
+# DOMAIN=https://vw.domain.tld
+## For public server (URL with port number)
+# DOMAIN=https://vw.domain.tld:8443
+## For public server (URL with path)
+# DOMAIN=https://domain.tld/vw
+DOMAIN=https://vault.netoik.io

netoik-vault.spec

@@ -22,14 +22,49 @@ Install the secrets vault called vaultwarden with a predefined configuration.
 %make_install
 
 %post
+# Display commands and exit on error
+set -xe
+
+# Change rights of config file
+chgrp vaultwarden %{_sysconfdir}/vaultwarden/netoik_vaultwarden.cfg
+
+# Add vaultwarden user to postgres group
+usermod --groups postgres --append vaultwarden
+
+# Create postgres user and db
+if ! runuser --user=postgres -- psql --quiet --tuples-only --command='\du' | grep --quiet vaultwarden; then
+  runuser --user=postgres -- createuser vaultwarden
+fi
+if ! runuser --user=postgres -- psql --quiet --tuples-only --command='\l' | grep --quiet vaultwarden; then
+  runuser --user=postgres -- createdb --owner=vaultwarden vaultwarden
+fi
+
 # Restart services
 systemctl daemon-reload
 systemctl reenable nginx.service vaultwarden.service
 systemctl restart nginx.service vaultwarden.service
 
 %postun
+# Display commands and exit on error
+set -xe
+
+# If uninstalling, then delete users and db
+if [ $1 == 0 ]; then
+  # Remove gitea database if existing
+  if runuser --user=postgres -- psql --quiet --tuples-only --command='\l' | grep --quiet vaultwarden; then
+    runuser --user=postgres -- dropdb vaultwarden
+  fi
+  if runuser --user=postgres -- psql --quiet --tuples-only --command='\du' | grep --quiet vaultwarden; then
+    runuser --user=postgres -- dropuser vaultwarden
+  fi
+fi
 
 %files
+%attr(644, root, root) %{_sysconfdir}/nginx/conf.d/vault.netoik.io.conf
+%attr(640, root, -) %{_sysconfdir}/vaultwarden/netoik_vaultwarden.cfg
+
+%dir %attr(755, root, root) %{_unitdir}/vaultwarden.service.d
+%attr(644, root, root) %{_unitdir}/vaultwarden.service.d/vaultwarden.conf
 
 %changelog
 %autochangelog