{ ... }:
{
  vaultwarden.content = [
    {
      apiVersion = "apps/v1";
      kind = "Deployment";
      metadata = {
        name = "vaultwarden";
        labels.app = "vaultwarden";
      };
      spec = {
        selector.matchLabels.app = "vaultwarden";
        template = {
          metadata = {
            labels.app = "vaultwarden";
          };
          spec = {
            securityContext = {
              runAsUser = 1000;
              runAsGroup = 1000;
            };
            containers = [
              {
                name = "vaultwarden";
                image = "vaultwarden/server:latest";
                ports = [
                  {
                    name = "vw-http";
                    containerPort = 80; 
                  }
                ];
                env = [
                  { name = "DOMAIN"; value = "https://vault.nyxerinys.dev"; }
                  { name = "SSO_ENABLED"; value = "true"; }
                  { name = "SSO_AUTHORITY"; value = "https://auth.nyxerinys.dev/application/o/vaultwarden/"; }
                  { name = "SSO_SCOPES"; value = "email profile offline_access"; }
                  { name = "SSO_ALLOW_UNKNOWN_EMAIL_VERIFICATION"; value = "false"; }
                  { name = "SSO_CLIENT_CACHE_EXPIRATION"; value = "0"; }
                  { name = "SSO_ONLY"; value = "true"; }
                  { name = "SSO_SIGNUPS_MATCH_EMAIL"; value = "true"; }
                  {
                    name = "SSO_CLIENT_ID";
                    valueFrom.secretKeyRef = {
                      name = "vaultwarden-secrets";
                      key = "sso_client_id";
                    };
                  }
                  {
                    name = "SSO_CLIENT_SECRET";
                    valueFrom.secretKeyRef = {
                      name = "vaultwarden-secrets";
                      key = "sso_client_secret";
                    };
                  }
                ];
                volumeMounts = [
                  {
                    mountPath = "/data";
                    name = "iscsi";
                    subPath = "vaultwarden";
                  }
                ];
              }
            ];
            volumes = [
              {
                name = "iscsi";
                iscsi = {
                  targetPortal = "10.5.0.2:3260";
                  iqn = "iqn.2026-01.dev.nyxerinys:poseidon.vaultwarden";
                  lun = 0;
                  fsType = "xfs";
                  readOnly = false;
                };
              }
            ];
          };
        };
      };
    }
    {
      apiVersion = "v1";
      kind = "Service";
      metadata.name = "vaultwarden";
      spec = {
        type = "NodePort";
        selector.app = "vaultwarden";
        ports = [
          {
            name = "vw-http";
            protocol = "TCP";
            port = 80;
            nodePort = 30002;
          }
        ];
      };
    }
  ];
}