{ config, pkgs, lib, ... }: {
  services.vaultwarden = {
    enable = true;
    # backupDir =
    config = {
      domain = "https://bitwarden.ingolf-wagner.de";
      signupsAllowed = false;
      rocketPort = 8222;
      rocketLog = "critical";
    };
  };

  backup.dirs = [ "/var/lib/bitwarden_rs" ];

  services.nginx = {
    enable = true;
    recommendedProxySettings = true;
    virtualHosts = {

      "bitwarden.ingolf-wagner.de" = {
        forceSSL = true;
        enableACME = true;
        locations."/" = {
          proxyPass = "http://localhost:${
              toString config.services.vaultwarden.config.rocketPort
            }";
        };
      };
    };
  };

}