{
  services.vaultwarden = {
    enable = true;
    config = {
      DOMAIN = "https://vaultwarden.vatthauer.xyz";
      SIGNUPS_ALLOWED = false;

      ROCKET_ADDRESS = "127.0.0.1";
      ROCKET_PORT = 8222;

      ROCKET_LOG = "critical";

      ADMIN_TOKEN = "${../../nix-secrets/willem/vaultwarden/admin-token}";

      YUBICO_CLIENT_ID = "${../../nix-secrets/willem/vaultwarden/yubico-id}";
      YUBICO_SECRET_KEY = "${../../nix-secrets/willem/vaultwarden/yubico-secret}";
    };
  };
}