{...}: {
  services.vaultwarden = {
    enable = true;
    dbBackend = "sqlite";

    # backupDir = "/var/backup/vaultwarden"; # disable with null

    # https://mynixos.com/nixpkgs/option/services.vaultwarden.config
    config = {
      # internal address and port to listen on
      ROCKET_ADDRESS = "127.0.0.1";
      ROCKET_PORT = 8222;

      # hostname to listen for
      DOMAIN = "https://vault.imbored.dev";

      # signup policy
      SIGNUPS_ALLOWED = false;
      SIGNUPS_VERIFY = true;
      INVITATIONS_ALLOWED = true;
    };
    # https://mynixos.com/nixpkgs/option/services.vaultwarden.environmentFile
    environmentFile = "/var/lib/vaultwarden/vaultwarden.env";
  };
}