{
  config,
  lib,
  pkgs,
  ...
}: let
  cfg = config.hardened;
in {
  options.hardened.agenix.identityPaths = lib.mkOption {
    type = lib.types.listOf lib.types.str;
    default = ["/persistent/age-tpm.txt"];
    description = "List of identity paths for agenix";
  };

  config = lib.mkIf cfg.agenix.enable {
    boot.initrd.availableKernelModules = ["tpm_crb" "tpm_tis"];

    age = {
      inherit (cfg.agenix) identityPaths;
      ageBin = "PATH=$PATH:${lib.makeBinPath [pkgs.age-plugin-tpm]} ${pkgs.age}/bin/age";
    };

    environment.systemPackages = with pkgs; [
      age
      age-plugin-tpm
    ];

    environment.persistence = lib.mkIf config.hardened.impermanence.enable {
      "/persistent" = {
        directories = [
          "/var/lib/agenix"
        ];
      };
    };
  };
}