{ config, lib, pkgs, ... }: { services.vaultwarden = { enable = true; config = { DATA_FOLDER="/persist/var/lib/vaultwarden/data"; LOG_LEVEL="error"; SIGNUPS_ALLOWED=false; SIGNUPS_VERIFY=true; SIGNUPS_DOMAINS_WHITELIST="hacc.space"; ORG_CREATION_USERS="admin@hacc.space"; INVITATIONS_ALLOWED=true; INVITATION_ORG_NAME="haccwarden"; TRASH_AUTO_DELETE_DAYS=90; DOMAIN="https://pw.hacc.space"; ROCKET_ADDRESS="127.0.0.1"; ROCKET_PORT=5354; ROCKET_WORKERS=2; SMTP_HOST="mail.hacc.space"; SMTP_FROM="vaultwarden@hacc.space"; SMTP_FROM_NAME="haccwarden"; SMTP_PORT=587; SMTP_USERNAME="noreply@infra4future.de"; }; environmentFile = "/persist/var/lib/vaultwarden/vaultwarden.env"; #contains SMTP_PASSWORD dbBackend = "sqlite"; backupDir = "/persist/data/vaultwarden_backups/"; }; #work around ProtectSystem=strict, cleanup systemd.services.vaultwarden.serviceConfig = { ReadWritePaths = [ "/persist/var/lib/vaultwarden" ]; StateDirectory = lib.mkForce ""; }; services.nginx.virtualHosts."pw.hacc.space" = { locations."/" = { proxyPass = "http://127.0.0.1:5354"; proxyWebsockets = true; }; forceSSL = true; enableACME = true; }; }