From 25729b3bfd189b4b2894efcf1e56689be008841f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Mon, 8 Dec 2025 23:01:52 +0100
Subject: [PATCH] nixos/vaultwarden: add configurePostgres option

---
 .../services/security/vaultwarden/default.nix | 22 ++++++++++++++++++-
 1 file changed, 21 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/services/security/vaultwarden/default.nix b/nixos/modules/services/security/vaultwarden/default.nix
index 9b67ec506580..d8b19dfb282d 100644
--- a/nixos/modules/services/security/vaultwarden/default.nix
+++ b/nixos/modules/services/security/vaultwarden/default.nix
@@ -7,6 +7,7 @@
 
 let
   cfg = config.services.vaultwarden;
+
   user = config.users.users.vaultwarden.name;
   group = config.users.groups.vaultwarden.name;
 
@@ -163,6 +164,12 @@ in
       description = "Whether to configure nginx to serve VaultWarden.";
     };
 
+    configurePostgres = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "Whether to configure a local PostgreSQL server.";
+    };
+
     domain = lib.mkOption {
       type = with lib.types; nullOr str;
       default = null;
@@ -234,8 +241,20 @@ in
         };
       };
 
+      postgresql = lib.mkIf cfg.configurePostgres {
+        enable = true;
+        ensureDatabases = [ "vaultwarden" ];
+        ensureUsers = [
+          {
+            name = "vaultwarden";
+            ensureDBOwnership = true;
+          }
+        ];
+      };
+
       vaultwarden.config = lib.mkMerge [
         {
+          DATABASE_URL = lib.mkIf cfg.configurePostgres "postgresql:///vaultwarden?host=/run/postgresql";
           DOMAIN = lib.mkIf (cfg.domain != null) "https://${cfg.domain}";
         }
         (lib.mkIf cfg.configureNginx {
@@ -248,7 +267,8 @@ in
 
     systemd = {
       services.vaultwarden = {
-        after = [ "network-online.target" ];
+        after = [ "network-online.target" ] ++ lib.optional cfg.configurePostgres "postgresql.target";
+        requires = lib.mkIf cfg.configurePostgres [ "postgresql.target" ];
         wants = [ "network-online.target" ];
         path = with pkgs; [ openssl ];
         serviceConfig = {