{
  pkgs,
  lib,
  ...
}: {
  services.vaultwarden = {
    enable = true;
    dbBackend = "sqlite";
    backupDir = "/var/local/vaultwarden/backup";
    config = {
      DOMAIN = "https://vt.nicknase27.com";
      SIGNUPS_ALLOWED = "true";

      ROCKET_ADDRESS = "0.0.0.0";
      ROCKET_PORT = 8222;
      ROCKET_LOG = "critical";
    };
    environmentFile = ["/run/secrets/vaultwarden.env"];
  };
  networking.firewall.allowedTCPPorts = [8222];
  age.secrets.vaultwarden = {
    file = ../../secrets/vaultwarden.age;
    path = "/run/secrets/vaultwarden.env";
  };
}