{...}: let
  ipInternal = "10.13.1.1";

  dom = "pw.min.rip";
in {
  services.vaultwarden = {
    enable = true;

    config = {
      DOMAIN = "https://${dom}";
      SIGNUPS_ALLOWED = false;
      SHOW_PASSWORD_HINT = false;

      ROCKET_ADDRESS = ipInternal;
      ROCKET_PORT = 14210;
    };
  };
}