nix/hosts/marvin/services/vaultwarden.nix

{pkgs, ...}: {
  services.vaultwarden = {
    enable = true;
    dbBackend = "sqlite";
    webVaultPackage = pkgs.vaultwarden-vault;
    config = {
      webVaultFolder = "${pkgs.vaultwarden-vault}/share/vaultwarden/vault";
      domain = "https://bw.thehedgehog.me";
      useSyslog = true;
      rocketCliColors = "off";
      enableDbWal = true;
      iconService = "internal";
      disable2faRemember = false;
      signupsAllowed = false;
      signupsVerify = true;
      signupsDomainWhitelist = "mrhedgehog.xyz,thehedgehog.me";
      trashAutoDeleteDays = 14;
      authenticatorDisableTimeDrift = false;
      smtpFrom = "vaultwarden@thehedgehog.me";
      smtpFromName = "The Hedgehog's Vaultwarden";
      smtpUsername = "vaultwarden@thehedgehog.me";
      smtpSsl = true;
      smtpPort = 587;
      smtpHost = "smtp.migadu.com";
      smtpAuthMechanism = "Login";
    };
    environmentFile = "/run/agenix/vaultwarden-vars";
  };
  environment.systemPackages = with pkgs; [vaultwarden-vault];
}