Added Vaultwarden; Not tested

nixos/roles/vaultwarden.nix

@@ -0,0 +1,41 @@
+{ config, pkgs, ... }:
+
+let
+  address = config.systemd.network.networks."10-ethernet".networkConfig.Address;
+  ip = builtins.head (builtins.splitVersion address); # strips the /24
+  port = 8222;
+in
+{
+  services.vaultwarden = {
+    enable = true;
+    environmentFile = config.sops.templates.vaultwarden_env.path;
+    backupDir = "/var/lib/vaultwarden/backup";
+
+    config = {
+      DOMAIN = "http://${ip}:${toString port}";
+      ROCKET_ADDRESS = "0.0.0.0";
+      ROCKET_PORT = port;
+      ROCKET_LOG = "critical";
+      SIGNUPS_ALLOWED = false;
+      WEBSOCKET_ENABLED = true;
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [ port ];
+
+  systemd.services.vaultwarden-backup-rotate = {
+    description = "Rotate old Vaultwarden backups";
+    serviceConfig = {
+      Type = "oneshot";
+      ExecStart = "${pkgs.findutils}/bin/find /var/lib/vaultwarden/backup -mtime +30 -delete";
+    };
+  };
+
+  systemd.timers.vaultwarden-backup-rotate = {
+    wantedBy = [ "timers.target" ];
+    timerConfig = {
+      OnCalendar = "daily";
+      Persistent = true;
+    };
+  };
+}

nixos/sops.nix

@@ -1,4 +1,4 @@
-{ primaryUser, ... }:
+{ primaryUser, config, ... }:
 {
   sops = {
     defaultSopsFile = ../secrets/secrets.yaml;
@@ -14,6 +14,17 @@
         owner = "matrix-synapse";
         group = "matrix-synapse";
       };
+      vaultwarden_admin_token = {
+        owner = "vaultwarden";
+        group = "vaultwarden";
+      };
+    };
+    templates.vaultwarden_env = {
+      content = ''
+        ADMIN_TOKEN=${config.sops.placeholder.vaultwarden_admin_token}
+      '';
+      owner = "vaultwarden";
+      group = "vaultwarden";
     };
   };
 }