{ pkgs, ... }:

{
  services.vaultwarden = {
    enable = true;
    config = {
      domain = "https://vault.sincerity.network";
      signupsAllowed = true;
      rocketPort = 3011;
      rocketLog = "critical";
    };
    dbBackend = "sqlite";
  };

  services.nginx = {
    virtualHosts."vault.sincerity.network" = {
      enableACME = true;
      forceSSL = true;
      extraConfig = ''
        client_max_body_size 128M;
      '';
      locations."/" = {
        proxyPass = "http://localhost:3011";
      };
    };
  };
}