use agenix

modules/services/vaultwarden.nix

@@ -1,6 +1,7 @@
 { lib, config, ... }:
 let
   cfg = config.modules.services.vaultwarden;
+  secrets = config.age.secrets;
   fqdn = "${cfg.subdomain}.${config.networking.domain}";
   port = config.services.vaultwarden.config.ROCKET_PORT;
 in
@@ -23,7 +24,7 @@ in
     services.vaultwarden = {
       enable = true;
       dbBackend = "postgresql";
-      environmentFile = "/var/secrets/vaultwarden.env";
+      environmentFile = secrets.vaultwarden.path;
       config = {
         DOMAIN = "https://${fqdn}";
         DATABASE_URL = "postgres://%2Fvar%2Frun%2Fpostgresql/vaultwarden";