diff --git a/secrets/crypt/secrets.json b/secrets/crypt/secrets.json
index eee8fbf..c5c6780 100644
Binary files a/secrets/crypt/secrets.json and b/secrets/crypt/secrets.json differ
diff --git a/secrets/sops/secrets.yaml b/secrets/sops/secrets.yaml
index d1e7e9b..a2fd5b4 100644
--- a/secrets/sops/secrets.yaml
+++ b/secrets/sops/secrets.yaml
@@ -4,10 +4,6 @@ github:
     runner: ENC[AES256_GCM,data:i+0mDBPrRxo6k7lrG5JfvPYPBhDuw69ubCY2M0MMZczu97b3QdnKZw==,iv:zOuGzA6M32u00MC+Cc1ypHBbQIWytUQEyJTUuHO0gSs=,tag:n08pp173HqF9eqmIxjzMAg==,type:str]
     runner-oasys: ENC[AES256_GCM,data:s6DicaREOQ6hC9MIcw/PY6lX0PAcnoDzrKZDNJkDlNp9sYOskwDyLkpWbuakbl+kC9x9CjeP4608o7Gey/HTB74Veza689W4FMn+ySFD038ilU3AjzZLJffQl9/J,iv:j6RJ4PP6y/jsid0mvcn7re6stx8+QV5ci1s3kuAiVQI=,tag:6WUG9DKf5Sj+orJZSfC4Iw==,type:str]
     nixpkgs-update: ENC[AES256_GCM,data:aTQC7w59Z0u4po3C7oWbIiWgahK9tOfQNwoQRKYgGSCMsCNq07E+mA==,iv:8Dyu1lJACYa6HnVcppkGr/1tcV8vMu7qQrdcXchhgkk=,tag:U8z64cxoPkSeV5gxDkC/KA==,type:str]
-postgresql:
-    vaultwarden: ENC[AES256_GCM,data:hZJcZ8w2YT4SH4aLxnffoeuEyNnOISiGfidEHM4e/cFbbpvxna2R96h0aqg=,iv:YKvXB8IxDUeBeRQZNQrGfahLLswInzi5ZOZrMvpNq/I=,tag:Ak/NSwXjtuwthCIl+jyN8w==,type:str]
-    forgejo: ENC[AES256_GCM,data:f4NHIfVFnzJOoKKySrBKAj/2aWq0lz4zaWiyaUaR0ETOC2LcpMPZ9cgfDTs=,iv:Y1NaVqdHUewhpMc08ZpUBujx3iw0r2z8l0wXfaJ4E6Q=,tag:aS5H6YIDjovSmJUk6mVOWw==,type:str]
-    grafana: ENC[AES256_GCM,data:NyE0vaUi6ECgX0gMpx8qa5D4kRc6qpsiuVjPkh78q3+HuOs5AEPnpwf22kw=,iv:qp3Xx9NgxTBTkMJKHhnYmjckVzHjAuqgK3gCo7t8A60=,tag:cfzVUg89uO1urOKYDYQRhw==,type:str]
 tailscale:
     actions: ENC[AES256_GCM,data:2eIgnhfYt8ZSrEPZ2d7ynHU5WhB3DUnBSPjMx3tQaL6sxuOmHUN5NuLdL7aot/RWn/A9SMcDTJdsDAwo,iv:E04WX6G8M5n8x36YgyMT2lDzsPqluLSd1p4Q6UHbm4M=,tag:TJdJ+ioeitGf+MyapXqyPg==,type:str]
     tsdproxy: ENC[AES256_GCM,data:FZNL/UATBqS/Wp2LyA+bvzivSk8yunywAyjUKxYrAWiMzxhooJDlkcY/MZnO4TlG2JIfX8i1BKyjGbpWyj8=,iv:ujv/yxbVkeeJkK9JoYnySvsbMIsbU1FN/TfqMz4fTmk=,tag:i7zE1J6Fh8MCB2LDbho0YQ==,type:str]
@@ -52,7 +48,7 @@ sops:
             ZUZQcjZod1orQ1VKaEJ0QjJIKzlOQzAKvhXUFxOP9UYoLfurNCuVB/1joob2oAB9
             /wC3fMo0STB1oUTNr5r6liMfjzm8ZdbHolK1TzMkrePz6zznFkJL1w==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-05-05T01:34:07Z"
-    mac: ENC[AES256_GCM,data:NkZvdZco75WjtssAOzxjARduFW57MZDZmgR0U9+76aR6PDornheX0y6a/LQ0z7++l0yy1MO68QpvIolImdDvkGNyW/bvBQCQGMF94RXjtUKEcB9QbPYjb0csBTcuKBvJglmkQU+Jqk/qphiUnyBYiORepb9F9DC9VfuNQ5VGjQo=,iv:JMaOl4YYuyKdh6w6pM/WYZK3f/6x8RbwAskWlPDhn7U=,tag:qRFxMY50X981LcUD5QP+pA==,type:str]
+    lastmodified: "2025-05-05T03:20:09Z"
+    mac: ENC[AES256_GCM,data:oYq4IHWP/pysaQWdzTrVgppdQOlZ+aPYMaivYUfxPsP2UaMgn3CLfnvOWM/68xU3HzdkjFn0A51Q/25X42efs3jHTY72u7kdL3GfePsBdxNOAb1GMtd/QrmTDMizlfSBgb5IZhb/eQB2joMg8W/FYoWna/TgmwE+aXFQdBO5JSE=,iv:6df9ADqB2iQPymx29ptqe9aA8ncM1051NqdyfWonXKY=,tag:er4uJ36x1DlCfmtBgLp1qw==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.10.2
diff --git a/system/default.nix b/system/default.nix
index 3483442..063dc29 100644
--- a/system/default.nix
+++ b/system/default.nix
@@ -98,6 +98,11 @@ in {
         host = "chibi";
         port = 5201;
       };
+
+      vaultwarden = {
+        host = "shiori";
+        port = 5300;
+      };
     };
 
     unbound.dnsHost = "chibi";
diff --git a/system/hosts/shiori/default.nix b/system/hosts/shiori/default.nix
index db762fe..5eb870c 100644
--- a/system/hosts/shiori/default.nix
+++ b/system/hosts/shiori/default.nix
@@ -17,6 +17,8 @@
 
   httpd.enable = true;
 
+  vaultwarden.enable = true;
+
   samba.mounts = {
     "shared" = "arisu";
   };
diff --git a/system/secrets.nix b/system/secrets.nix
index e68a75b..1362092 100644
--- a/system/secrets.nix
+++ b/system/secrets.nix
@@ -18,10 +18,6 @@ in {
     secrets = {
       "master-password" = {owner = c4patino.name;};
 
-      "postgresql/forgejo" = {owner = c4patino.name;};
-      "postgresql/grafana" = {owner = c4patino.name;};
-      "postgresql/vaultwarden" = {owner = c4patino.name;};
-
       "github/auth" = {owner = c4patino.name;};
       "github/runner" = {owner = c4patino.name;};
       "github/runner-oasys" = {owner = c4patino.name;};
diff --git a/system/services/default.nix b/system/services/default.nix
index 6a58d12..74ba524 100644
--- a/system/services/default.nix
+++ b/system/services/default.nix
@@ -9,5 +9,6 @@
     ./pm2.nix
     ./slurm.nix
     ./uptime-kuma.nix
+    ./vaultwarden.nix
   ];
 }
diff --git a/system/services/storage/postgresql.nix b/system/services/storage/postgresql.nix
index a4053b4..51a4b45 100644
--- a/system/services/storage/postgresql.nix
+++ b/system/services/storage/postgresql.nix
@@ -21,7 +21,12 @@ in {
     services = {
       postgresql = {
         enable = true;
-        settings.port = port;
+        enableTCPIP = true;
+
+        settings = {
+          port = port;
+        };
+
         authentication = let
           permissionEntries =
             cfg.databases
diff --git a/system/services/vaultwarden.nix b/system/services/vaultwarden.nix
new file mode 100644
index 0000000..40e8bdc
--- /dev/null
+++ b/system/services/vaultwarden.nix
@@ -0,0 +1,53 @@
+{
+  pkgs,
+  lib,
+  config,
+  secrets,
+  ...
+}: let
+  inherit (lib) mkIf mkEnableOption filterAttrs head;
+  cfg = config.vaultwarden;
+  pgCfg = config.postgresql;
+
+  port = 5300;
+
+  resolveHostIP = node:
+    if builtins.hasAttr node config.devices
+    then config.devices.${node}.IP
+    else builtins.throw "Host '${node}' does not exist in the devices configuration.";
+in {
+  options.vaultwarden.enable = mkEnableOption "vaultwarden";
+
+  config = mkIf cfg.enable {
+    services.vaultwarden = {
+      enable = true;
+      package = pkgs.vaultwarden-postgresql;
+      dbBackend = "postgresql";
+      config = {
+        DOMAIN = "http://vaultwarden.yumeami.sh";
+
+        SIGNUPS_ALLOWED = false;
+        SIGNUPS_VERIFY = false;
+
+        DATABASE_URL = let
+          ip =
+            pgCfg.databases
+            |> filterAttrs (host: dbs: lib.elem "vaultwarden" dbs)
+            |> lib.attrNames
+            |> head
+            |> resolveHostIP;
+        in ''postgresql://vaultwarden:${secrets.postgresql.vaultwarden}@${ip}:5600/vaultwarden'';
+
+        LOG_LEVEL = "Info";
+
+        ROCKET_ADDRESS = "0.0.0.0";
+        ROCKET_PORT = port;
+        ROCKET_LOG = "critical";
+
+        EXPERIMENTAL_CLIENT_FEATURE_FLAGS = "autofill-v2,extension-refresh,ssh-key-vault-item,ssh-agent";
+      };
+    };
+
+    networking.firewall.allowedTCPPorts = [port];
+  };
+}