{
  flake.modules.nixos.vaultwarden =
    { config, ... }:
    {
      services.vaultwarden = {
        enable = true;
        backupDir = "/var/backup/vaultwarden";
        config = {
          DOMAIN = "https://vault.jelles.net";
          SIGNUPS_ALLOWED = false;
          ROCKET_PORT = 8100;
          ROCKET_LOG = "critical";
        };
      };

      services.caddy.virtualHosts."vault.jelles.net".extraConfig =
        "reverse_proxy :${toString config.services.vaultwarden.config.ROCKET_PORT}";
    };
}