vaultwarden: add nullmailer to systemd service

modules/crans/nullmailer.nix

@@ -4,6 +4,7 @@
   services.nullmailer = {
     enable = true;
 
+    setSendmail = true;
     config = {
       remotes = ''
         smtp.adm.crans.org smtp

modules/services/vaultwarden.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, ... }:
+{ config, lib, ... }:
 
 {
   imports = [
@@ -14,7 +14,26 @@
   services.vaultwarden = {
     enable = true;
     dbBackend = "postgresql";
+
     environmentFile = config.age.secrets.env.path;
+    config = {
+      SENDMAIL_COMMAND = "${config.security.wrapperDir}/sendmail";
+    };
+  };
+  users.users.vaultwarden.extraGroups = [ "nullmailer" ];
+
+  systemd.services.vaultwarden = {
+    path = [ "/run/wrappers" ];
+    serviceConfig = {
+      NoNewPrivileges = lib.mkForce false;
+      PrivateUsers = lib.mkForce false;
+      SystemCallFilter = lib.mkForce [ "@system-service" ];
+      RestrictAddressFamilies = [
+        "AF_LOCAL"
+        "AF_NETLINK"
+      ];
+      ReadWritePaths = [ "/var/spool/nullmailer/" ];
+    };
   };
 
   services.nginx.virtualHosts."vaultwarden.crans.org" = {