diff --git a/machines/bomba/secrets.nix b/machines/bomba/secrets.nix
index dd764cd..ddb528e 100644
--- a/machines/bomba/secrets.nix
+++ b/machines/bomba/secrets.nix
@@ -25,6 +25,7 @@
         navidrome_env = default;
         yamtrack_env = default;
         authentik_env = default;
+        vaultwarden_env = default;
       };
     };
 }
diff --git a/machines/bomba/services/caddy.nix b/machines/bomba/services/caddy.nix
index ac19aea..719416f 100644
--- a/machines/bomba/services/caddy.nix
+++ b/machines/bomba/services/caddy.nix
@@ -34,7 +34,7 @@
         '';
         "vaultwarden.patrickcanal.it".extraConfig = ''
           encode zstd gzip
-          reverse_proxy :${toString config.services.vaultwarden.config.ROCKET_PORT} {
+          reverse_proxy :8003 {
             header_up X-Real-IP {remote_host}
           }
         '';
diff --git a/machines/bomba/services/vaultwarden.nix b/machines/bomba/services/vaultwarden.nix
index 83b52a4..eb6ca76 100644
--- a/machines/bomba/services/vaultwarden.nix
+++ b/machines/bomba/services/vaultwarden.nix
@@ -1,11 +1,26 @@
-{ ... }:
+{ config, ... }:
 {
   services.vaultwarden = {
     enable = true;
-    config = {
-      DOMAIN = "https://vaultwarden.patrickcanal.it";
-      ROCKET_ADDRESS = "127.0.0.1";
-      ROCKET_PORT = 8003;
-    };
+    environmentFile = config.sops.secrets.vaultwarden_env.path;
+    # config = {
+    #   DOMAIN = "https://vaultwarden.patrickcanal.it";
+    #   ROCKET_ADDRESS = "127.0.0.1";
+    #   ROCKET_PORT = 8003;
+    #   SSO_ENABLED = true;
+    #   SSO_ONLY = false;
+    #   SSO_AUTHORITY = "https://auth.patrickcanal.it";
+    #   SSO_SCOPES = [
+    #     "profile"
+    #     "email"
+    #     "offline_access"
+    #     "vaultwarden"
+    #   ];
+    #   SSO_PKCE = true;
+    #   SSO_CLIENT_ID = "vaultwarden";
+    #   SSO_CLIENT_SECRET = config.sops.secrets.vaultwarden_sso_secret;
+    #   SSO_ROLES_ENABLED = true;
+    #   SSO_ROLES_DEFAULT_TO_USER = true;
+    # };
   };
 }
diff --git a/secrets/bomba.sops.yaml b/secrets/bomba.sops.yaml
index 5a1537f..53d3b98 100644
--- a/secrets/bomba.sops.yaml
+++ b/secrets/bomba.sops.yaml
@@ -13,6 +13,7 @@ gitea_registration_token: ENC[AES256_GCM,data:aHoUBwPXtlme9RgGObwWt1V90JU5qeVBUt
 navidrome_env: ENC[AES256_GCM,data:SjEg735zoiWNjp0+uYi5CyLadDd7mSXpG1LInLsaqESz0LNgMi+r46ohPjpEC3GD+WbE9D3XRwhB22oIey3K7p3GdB/bYjIR6wOa8MVjj3EDvzdBWbnhkXsGnIhLGuyZwDmMdA==,iv:gHv7lZzU09V3XVjs3nEOEm55xRwD23+sVWfgbuX18p4=,tag:8UAMIGXPGobQfBAao2nI6Q==,type:str]
 yamtrack_env: ENC[AES256_GCM,data:viu/+B369Csc/nb1Psx5sIcrYw9IpUjtBPwiEAWRiBoCTlowLJ3xfRgUSx7w3/IhaCmuxEFTPBvIGCFFLgU0ZeHl5CnGe210O+uAgDpwJK+904zND3yVBPJmQ9u/ACHwqPOLON+ZFudEPtzW/5rkiQSXJdPelF28/0fkCLl1P7dVeEkwjRxPJKCt6lGv2WMlcqoHKEUCIsPWS/btRhzmLV5897AvZKTLDvrJxJi2yrPpfds=,iv:6i/1vFrwhGaq4pzCoX2og+kPRnJuqEWm9EqwOk9TSBA=,tag:122SE01quqmSjM4ttUn12w==,type:str]
 authentik_env: ENC[AES256_GCM,data:kAva3C4pWZ4+BFhGbbq9j1rSXeldb+NAwU16aZUD7wiw8k7Sg0kVq/43rj1HtR2ZTQY6DxhPlsK5I7opVAg953GwN0kTErpuhKLRWaRGSb8rC8kkxnY=,iv:X61qSjH18KQRWNOtYq1o8IZmY6Dz4TrJzehJWxE7b2o=,tag:mifmD1C3A+XSQveLviLt2w==,type:str]
+vaultwarden_env: ENC[AES256_GCM,data:vlwywspQDMrevce4dMgJTAbV4Fv9l8COK/k3ZMCZN4w0oIm4rQ3RfFzbagnG7oY9GRrqQNKM3gyRtxZ/5tPHHyiSNDDJ9lRBZ2g6w+VcVAmPyJaI736LOWZNwaYsK8yymfOWJuE8nZy5z07L/YjM+oQf0t6aqGIrHrwD4mB8GLIUhaDDNtB7xAJaDVtGCOKPseQGBwEXzs9S6hOKOUb/YeWXj290qDd9jVLSsBRZt8/ePxKMKnqSCekhrrlnGKGUitQBlHJgtUWd6wUtzR5DdTmh5Dn32JaAri51vlI+UuN6DOHxhh03rKsF5nTGXr1oclNMCrpk+uCOQZfjJ1U6jdz+vLxxuwocz3KRW2vi/v/MC2uutAu8KEskdcLBk+k6hnHse2WQ9HfePvY9hPcVMnnp1OaDLmJ3UnJsSuj+fTT/iGVyiDC+UpZ7XdF47VwohnYHbmsq30ruSxS05irhFqQ6Yla938V+l3ASSzAh7DNXmpGzYiit0evyt2wm+an29ulaU6oIaoh9etpvLK1I4WC9WjTG24Cq/4/S9d+Kzp6GaUxX7zOa9wANEAvPDHwUjreH/iIqbrIrbYBIdWLZacPWVj60JMP6ioaz8HfIsKel3q+pAfuZZbKJobSPOut/7jhz0RtLK9BN5zKv1UcAYRgcBF1Wy8d7eB5/k8IjDF6StfgJ+l5nEflrTx48ZouveMarincrj/i7PFmK2y5Ss31Xc3fvafPenxE8zT4CNaSu5RsUYQCIqAFcQfqdJSSu7S8OjQmzKGEwgFOhkG4mMqtPacvyNl2rDmgYcj8vbIkX5uC6wWejOJlqfDZwKIbnevBYaaoDLZWmzpqn47vBI4kveGLqhp2EqHH/yqAhz5Q=,iv:ziOAFuLGSngOmS9cOr8LE+Qf0Wh6CSCmWNHWFahpMUk=,tag:Ssm/6hC6A3t90502qo4zng==,type:str]
 sops:
     age:
         - enc: |
@@ -24,7 +25,7 @@ sops:
             ZQ17gIIOjhKHlGx8Lo5t/PekzFyQKCKdijS7caq74dVib1vO3tk+uQ==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1ynu6zhhy84rr5xqce0flp25x5tnfgskesxfe39u7ewsk900fvagq9sq0lx
-    lastmodified: "2026-07-22T21:31:17Z"
-    mac: ENC[AES256_GCM,data:z4AB4bpj/z3L7XuWrcxk76e+KatdHYB2HWIYNZsaVfaMfBtVDl0UVfpq/ajBgLNdmBaNZ+c/ePqpPMZ64nsvyseZFDkm+a8GvJBDevUEpi2YGtqT/M5dj/9hLDMcX2T+nk/u5inTjTuirndHSZW8bAHqL8s+bVsTBQ4wtoDrFNg=,iv:EVMAXtIvr6hdLHZ/+8fvMILP/iBrRucRKizeCYnFd9o=,tag:D3CU9YA7luRxpCiJ+MG0Pw==,type:str]
+    lastmodified: "2026-07-23T14:12:12Z"
+    mac: ENC[AES256_GCM,data:z39wy9mEVi+Rb/iod75gbnAj1ZET2QrTlN3VUyeBiP5SV8jvDJf62IrVdghwf+agIzp4nDfAm9SBjvoaCbi6ov9rXmQ0LHuHrnwJ715LcDtrinJluHh7jDmCc2rIETxSpJ1838Jbm3R6RdlUxsI+gVXmz42Uar7RzEL0aEu1kCM=,iv:F8aN/yQtFiY2nDayU+1/K6W6cMQDr4QA3t/psmGj7n4=,tag:HsitMG/lbm7k1uuWfDys9w==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.2