services.vaultwarden.config

The configuration of vaultwarden is done through environment variables, therefore it is recommended to use upper snake case (e.g. DISABLE_2FA_REMEMBER).

However, camel case (e.g. disable2FARemember) is also supported: The NixOS module will convert it automatically to upper case snake case (e.g. DISABLE_2FA_REMEMBER). In this conversion digits (0-9) are handled just like upper case characters, so foo2 would be converted to FOO_2. Names already in this format remain unchanged, so FOO2 remains FOO2 if passed as such, even though foo2 would have been converted to FOO_2. This allows working around any potential future conflicting naming conventions.

Based on the attributes passed to this config option an environment file will be generated that is passed to vaultwarden's systemd service.

The available configuration options can be found in the environment template file.

See for how to set up access to the Admin UI to invite initial users.

Declarations

nixos/modules/services/security/vaultwarden/default.nix

Type

attribute set of (null or boolean or signed integer or string)

Default

{
  ROCKET_ADDRESS = "::1";
  ROCKET_PORT = 8222;
}

Example

{
  DOMAIN = "https://bitwarden.example.com";
  SIGNUPS_ALLOWED = false;

  # Vaultwarden currently recommends running behind a reverse proxy
  # (nginx or similar) for TLS termination, see
  # https://github.com/dani-garcia/vaultwarden/wiki/Hardening-Guide#reverse-proxying
  # &gt; you should avoid enabling HTTPS via vaultwarden's built-in Rocket TLS support,
  # &gt; especially if your instance is publicly accessible.
  #
  # A suitable NixOS nginx reverse proxy example config might be:
  #
  #     services.nginx.virtualHosts."bitwarden.example.com" = {
  #       enableACME = true;
  #       forceSSL = true;
  #       locations."/" = {
  #         proxyPass = "http://127.0.0.1:${toString config.services.vaultwarden.config.ROCKET_PORT}";
  #       };
  #     };
  ROCKET_ADDRESS = "127.0.0.1";
  ROCKET_PORT = 8222;

  ROCKET_LOG = "critical";

  # This example assumes a mailserver running on localhost,
  # thus without transport encryption.
  # If you use an external mail server, follow:
  #   https://github.com/dani-garcia/vaultwarden/wiki/SMTP-configuration
  SMTP_HOST = "127.0.0.1";
  SMTP_PORT = 25;
  SMTP_SSL = false;

  SMTP_FROM = "[email protected]";
  SMTP_FROM_NAME = "example.com Bitwarden server";
}