{
  config,
  pkgs,
  lib,
  ...
}:
{

  environment.systemPackages = [
    pkgs.system-sendmail
  ];

  sops.secrets."vaultwarden/environmentFile" = {
    restartUnits = [ "vaultwarden.service" ];
    owner = "vaultwarden";
    mode = "0755";
  };

  services.vaultwarden = {
    enable = true;
    environmentFile = config.sops.secrets."vaultwarden/environmentFile".path;
    dbBackend = "sqlite";
    backupDir = "/var/backup/vaultwarden";
  };

  environment.snakeoil-certs.vaultwarden = {
    owner = "nginx";
    group = "nginx";
    subject = "/CN=vaultwarden";
    extraOpenSSLArgs = [
      "-addext"
      "subjectAltName=DNS:galadriel,DNS:*.galadriel,DNS:localhost,IP:127.0.0.1,IP:100.110.96.125"
    ];
  };

  services.nginx = {
    enable = lib.mkDefault true;
    recommendedProxySettings = true;
    virtualHosts."vaultwarden" = {
      onlySSL = true;
      sslCertificate = config.environment.snakeoil-certs.vaultwarden.certificate;
      sslCertificateKey = config.environment.snakeoil-certs.vaultwarden.certificateKey;
      listen = [
        {
          addr = "0.0.0.0";
          port = 8001;
          ssl = true;
        }
        {
          addr = "[::]";
          port = 8001;
          ssl = true;
        }
      ];
      locations."/" = {
        proxyPass = "http://127.0.0.1:8000";
        proxyWebsockets = true;
      };
    };
  };

  systemd.services.nginx = {
    after = [ "generate-snakeoil-certs.service" ];
    wants = [ "generate-snakeoil-certs.service" ];
  };

  networking.firewall.allowedTCPPorts = [ 8001 ];

}