{ config, lib, ... }: {
  system.stateVersion = "25.11";
  systemd.tmpfiles.rules = [
    "d /persist/vaultwarden 755 vaultwarden vaultwarden"
  ];
  networking.firewall.allowedTCPPorts = [ 8000 ];
  networking.firewall.allowedUDPPorts = [ 8000 ];

  services.vaultwarden = {
    enable = true;
    domain = "diamond.local.lava.moe";
    config = {
      DATA_FOLDER = "/persist/vaultwarden";
    };
  };
}