{ config, ... }:
let
  service = config.facts.services.vaultwarden;
  nixosModules = config.flake.modules.nixos;
in
{
  flake.modules.nixos.vaultwarden = {
    imports = [ nixosModules.caddy ];

    services.vaultwarden = {
      enable = true;
      backupDir = "/var/backup/vaultwarden";
      config = {
        DOMAIN = service.origin;
        SIGNUPS_ALLOWED = false;
        ROCKET_ADDRESS = "127.0.0.1";
        ROCKET_PORT = 8100;
        ROCKET_LOG = "critical";
      };
    };

    services.caddy.virtualHosts.${service.domain}.extraConfig = "reverse_proxy 127.0.0.1:8100";
  };
}