{config, ...}: let
  cfg = config.services.vaultwarden;
  domain = "vault.${config.networking.domain}";
in {
  services.vaultwarden = {
    enable = true;
  };
  services.nginx.virtualHosts.${domain} = {
    forceSSL = true;
    enableACME = true;
    locations."~".proxyPass = "http://localhost:${toString cfg.config.ROCKET_PORT}";
  };
}