draft AZ-PRM-1 config

hosts/AZ-PRM-1/services/vaultwarden.nix

@@ -0,0 +1,30 @@
+{config, ...}: {
+  services.vaultwarden = {
+    enable = true;
+    backupDir = "/var/backup/vaultwarden";
+    config = {
+      ROCKET_ADDRESS = "127.0.0.1";
+      ROCKET_PORT = 3030;
+    };
+    environmentFile = "${config.age.secrets.vaultwarden-env.path}";
+  };
+
+  # Traefik configuration for headscale
+  services.traefik.dynamicConfigOptions.http = {
+    services.vaultwarden.loadBalancer.servers = [
+      {
+        url = "http://localhost:3030/";
+      }
+    ];
+
+    routers.vaultwarden = {
+      rule = "Host(`pw.i.az-intec.com`)";
+      tls = {
+        certResolver = "ionos";
+      };
+      service = "vaultwarden";
+      entrypoints = "websecure";
+    };
+  };
+}
+