{ config, lib, pkgs, ... }:

{
  sops.defaultSopsFile = ../secrets.yaml;
  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];

  sops.secrets.cftoken = {
    owner = "maddy";
    group = "maddy";
    mode = "0440";
    restartUnits = [ "maddy.service" ];
  };

  sops.secrets.mxpass = {
    owner = "maddy";
    group = "maddy";
    mode = "0440";
    restartUnits = [ "maddy.service" ];
  };

  sops.secrets.s2guser = {
    owner = "maddy";
    group = "maddy";
    mode = "0440";
    restartUnits = [ "maddy.service" ];
  };

  sops.secrets.s2gpass = {
    owner = "maddy";
    group = "maddy";
    mode = "0440";
    restartUnits = [ "maddy.service" ];
  };
}