diff --git a/hosts/nyx.lewd.wtf/secrets.nix b/hosts/nyx.lewd.wtf/secrets.nix
new file mode 100644
index 0000000..e029b1b
--- /dev/null
+++ b/hosts/nyx.lewd.wtf/secrets.nix
@@ -0,0 +1,14 @@
+{ config, ... }:
+{
+  sops.defaultSopsFile = ./secrets/services.yaml;
+  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+
+  # Vaultwarden
+  sops.secrets."services/vaultwarden/.env" = {
+    mode = "0400";
+    owner = config.users.users.vaultwarden.name;
+    group = config.users.users.vaultwarden.group;
+    sopsFile = ./secrets/vaultwarden.env;
+    format = "dotenv";
+  };
+}
diff --git a/hosts/nyx.lewd.wtf/secrets/vaultwarden.env b/hosts/nyx.lewd.wtf/secrets/vaultwarden.env
new file mode 100644
index 0000000..1001e3b
--- /dev/null
+++ b/hosts/nyx.lewd.wtf/secrets/vaultwarden.env
@@ -0,0 +1,9 @@
+ADMIN_TOKEN=ENC[AES256_GCM,data:R1mhyfHnTvnWaeKL7UFUuaA8bmpoQciLXRgLZKTDH0Zvo/M76s/NSenBEtpfpUJMbHGp1hmXqkK6jR5WVemYhg==,iv:yCdNQbQx86CZU7GvShcL9YxOlzGr/bTfTp5DDMudTDs=,tag:yPXiqasJbj2NCc5vIc2zVw==,type:str]
+sops_mac=ENC[AES256_GCM,data:LkjzPt4EVD23fPtcSaAfn0zBSdHP2zo1oF3fRPS7yP+kKdsBUDVVHoS63GT4nUmzgok+AF23EyRhGRWX3TL4f7IqylU50K5NMrNwBCQw6X0DGAqrMnsrvpSCPdWkLcm8fqpo4K22I/0fZl2AXSzuMWY4NKDu2IB0j1eNpP4qILY=,iv:4pdUt5LxdaXl9CIP4lgcnQLI+IbCiEPkU3idorJput8=,tag:++XPxDInGY2f/n+7r43obw==,type:str]
+sops_unencrypted_suffix=_unencrypted
+sops_lastmodified=2023-04-15T07:50:09Z
+sops_age__list_1__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0UXYrVkxHSmx1V1E1aVlW\nTVMwamo2ZnJrbERDTkJoSS8yanVXZ2pEbEJnCjExM2U5T1U3SkVrNFhIaXg5VE9K\ncnNyUDdQM2IyQ2FpenV0VEhIR1NBaTQKLS0tIEsvOTNDa1BvUlk3UE01VGZydmVG\nZDZOelphR0Nsa3c4aXZ5NDJVWlVvQmsKPxUi8Vgxe+EsHSF/33OfoEdFIUscDTzR\nzjf8rkG5BU616tudvXUGLfdncCiG+hfz7ZvmEYlTEAdGzSYSW8tuhg==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_0__map_recipient=age17wdazshqnfe63cy7mmsmwld75e5wedgn8gngvmvlqdktlr86c4us87tjxv
+sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTdTRPUGxqcGowU0FjRE84\nNjhKdEJabFZEVXo3aTArQnNNRjhaMFZiKzNrCmpLbFoxTVlTUkYxOHVJdlFqa0JF\nQStIT29uSlY3SWtzZHFqbjZwTHZ1aEUKLS0tIHJlLzlCV0RJekVvOWRLV3JmZ2pv\nZ0VrUVg5NXVTWU5LRDk2M3dYWXM3bkEKA4KusPniM0pO6oJhHq1khrfcwdSvG+/A\n7rn6Ib23WSHUAquxCxOz9IXL2GDrajEFnv82lyYUgijgb7PEWC2pPQ==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_1__map_recipient=age1vnyex6qqzwl5laxgww9xzcqy9ht85s0etgq0esry8gk7ad0eaq8qz9p5ya
+sops_version=3.7.3
diff --git a/hosts/nyx.lewd.wtf/services/uptimekuma.nix b/hosts/nyx.lewd.wtf/services/uptimekuma.nix
index cddd5a4..9c4efec 100644
--- a/hosts/nyx.lewd.wtf/services/uptimekuma.nix
+++ b/hosts/nyx.lewd.wtf/services/uptimekuma.nix
@@ -5,6 +5,7 @@
         UPTIME_KUMA_PORT = "8099";
     };
   };
+
   services.nginx.virtualHosts."status.lewd.wtf" = {
     enableACME = true;
     forceSSL = true;
diff --git a/hosts/nyx.lewd.wtf/services/vaultwarden.nix b/hosts/nyx.lewd.wtf/services/vaultwarden.nix
new file mode 100644
index 0000000..ab2e3a8
--- /dev/null
+++ b/hosts/nyx.lewd.wtf/services/vaultwarden.nix
@@ -0,0 +1,55 @@
+{ config, ... }:
+{
+  users.users.vaultwarden.extraGroups = [ config.users.groups.keys.name ];
+
+  services.vaultwarden = {
+    enable = true;
+    environmentFile = "/run/secrets/services/vaultwarden/.env";
+    config = {
+      DOMAIN = "https://vault.lewd.wtf";
+      SIGNUPS_ALLOWED = false;
+      SIGNUPS_VERIFY = true;
+      INVITATIONS_ALLOWED = false;
+      WEBSOCKET_ENABLED = true;
+      WEBSOCKET_PORT = 3012;
+      ROCKET_PORT = 8222;
+    };
+  };
+
+  services.nginx.clientMaxBodySize = "128M";
+
+  services.nginx.virtualHosts."vault.lewd.wtf" = {
+    enableACME = false;
+    forceSSL = false;
+    locations."/" = {
+      proxyPass = "http://127.0.0.1:8222";
+      proxyWebsockets = true; # needed if you need to use WebSocket
+      extraConfig =
+        "proxy_set_header        Host $host;" +
+        "proxy_set_header        X-Real-IP $remote_addr;" +
+        "proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;" +
+        "proxy_set_header        X-Forwarded-Proto $scheme;"
+        ;
+    };
+    locations."/notifications/hub/negotiate" = {
+      proxyPass = "http://127.0.0.1:8222";
+      proxyWebsockets = true; # needed if you need to use WebSocket
+      extraConfig =
+        "proxy_set_header        Host $host;" +
+        "proxy_set_header        X-Real-IP $remote_addr;" +
+        "proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;" +
+        "proxy_set_header        X-Forwarded-Proto $scheme;"
+        ;
+    };
+    locations."/notifications/hub" = {
+      proxyPass = "http://127.0.0.1:3012";
+      proxyWebsockets = true; # needed if you need to use WebSocket
+      extraConfig =
+        "proxy_set_header        Host $host;" +
+        "proxy_set_header        X-Real-IP $remote_addr;" +
+        "proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;" +
+        "proxy_set_header        X-Forwarded-Proto $scheme;"
+        ;
+    };
+  };
+}