{ ... }: {
  age = {
    secrets = {
      atuin-env.file = ../../secrets/atuin-env.age;
      cache-key.file = ../../secrets/cache-key.age;
      gitlab-runner.file = ../../secrets/gitlab-runner.age;
      graf-email = {
        file = ../../secrets/graf-email.age;
        mode = "770";
        owner = "grafana";
        group = "grafana";
      };
      htpasswd-dock = {
        file = ../../secrets/htpasswd-dock.age;
        mode = "770";
        owner = "nginx";
        group = "nginx";
      };
      keys.file = ../../secrets/keys.age;
      miniflux.file = ../../secrets/miniflux.age;
      bitwarden-env.file = ../../secrets/bitwarden-env.age;
      transmission-env.file = ../../secrets/transmission-env.age;
      "restic/env".file = ../../secrets/restic/env.age;
      "restic/password".file = ../../secrets/restic/env.age;
      "restic/repo".file = ../../secrets/restic/env.age;
      "wireguard/server-private".file = ../../secrets/wireguard/server-private.age;
    };
    identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
  };
}