{...}: {
  services.secrets = {
    enable = true;

    vaultLogin = {
      enable = true;
      loginUsername = "raspberry";
    };

    requiredVaultPaths = [];

    secrets = {
      vault_password = {
        manual = true;
      };
    };
  };
}