{ secrets, ... }:
{
  services.vaultwarden = {
    enable = true;
    config = {
      domain = "https://vault.leaf.ninja";
      signupsAllowed = false;
      rocketAddress = "0.0.0.0";
      rocketPort = 8222;
      smtpHost = "smtp.migadu.com";
      smtpFrom = "vaultwarden@leaf.ninja";
      smtpPort = 587;
      smtpSecurity = "starttls";
      smtpUsername = "vaultwarden@leaf.ninja";
      smtpPassword = secrets.vaultwarden.smtpPassword;
    };
  };

  networking.firewall.allowedTCPPorts = [ 8222 ];
}