{ den, ... }:
{
  lux.services._.vaultwarden = den.lib.take.exactly ({ host }: {
    nixos = { config, ... }: {
      services.vaultwarden = {
        enable = true;
        backupDir = "/var/backup/vaultwarden";
        config = {
          DOMAIN = "https://vault.${host.domain}";
          SIGNUPS_ALLOWED = false;
          ROCKET_PORT = 8100;
          ROCKET_LOG = "critical";
        };
      };

      services.caddy.virtualHosts."vault.${host.domain}".extraConfig =
        "reverse_proxy :${toString config.services.vaultwarden.config.ROCKET_PORT}";
    };
  });
}