{ config, ... }:
let
  service = config.facts.services.vaultwarden;
in
{
  flake.modules.nixos.vaultwarden = {
    services.vaultwarden = {
      enable = true;
      backupDir = "/var/backup/vaultwarden";
      config = {
        DOMAIN = service.url;
        SIGNUPS_ALLOWED = false;
        ROCKET_PORT = service.port;
        ROCKET_LOG = "critical";
      };
    };

    services.caddy.virtualHosts.${service.domain}.extraConfig =
      "reverse_proxy :${toString service.port}";
  };
}