{
  # config,
  # lib,
  # pkgs,
  args,
  ...
}:

# Nix secrets hehe :3
{
  imports = [
    args.flakes.sops-nix.nixosModules.sops
  ];

  sops = {
    age.generateKey = false;

    secrets = {
      wireguard_snowlab_pub = {
        format = "binary";
        sopsFile = ../snowlab/wireguard.pub;

        mode = "0400";
        owner = "systemd-network";
      };

      wireguard_snow-den_pub = {
        format = "binary";
        sopsFile = ../snowcloud/wireguard.pub;

        mode = "0400";
        owner = "systemd-network";
      };

      wireguard_snowflake_pub = {
        format = "binary";
        sopsFile = ../snowflake/wireguard.pub;

        mode = "0400";
        owner = "systemd-network";
      };

      postgres_sql = {
        format = "binary";
        sopsFile = ./postgres.sql;

        mode = "0400";
        owner = "postgres";
      };

      pgdog_users = {
        format = "binary";
        sopsFile = ./pgdog_users.toml;

        mode = "0440";
        group = "pgdog_secrets";
        restartUnits = [ "pgdog.service" ];
      };

      caddy_env = {
        format = "dotenv";
        sopsFile = ./caddy.env;

        mode = "0400";
        restartUnits = [ "caddy.service" ];
      };

      ente_key_encryption = {
        sopsFile = ./ente.yaml;
        key = "key_encryption";

        mode = "0400";
        owner = "ente";
        restartUnits = [ "ente.service" ];
      };

      ente_key_hash = {
        sopsFile = ./ente.yaml;
        key = "key_hash";

        mode = "0400";
        owner = "ente";
        restartUnits = [ "ente.service" ];
      };

      ente_jwt_secret = {
        sopsFile = ./ente.yaml;
        key = "jwt_secret";

        mode = "0400";
        owner = "ente";
        restartUnits = [ "ente.service" ];
      };

      ente_s3_key = {
        sopsFile = ./ente.yaml;
        key = "s3_key";

        mode = "0400";
        owner = "ente";
        restartUnits = [ "ente.service" ];
      };

      ente_s3_secret = {
        sopsFile = ./ente.yaml;
        key = "s3_secret";

        mode = "0400";
        owner = "ente";
        restartUnits = [ "ente.service" ];
      };

      ente_db_password = {
        sopsFile = ./ente.yaml;
        key = "db_password";

        mode = "0400";
        owner = "ente";
        restartUnits = [ "ente.service" ];
      };

      pgdog_env = {
        format = "dotenv";
        sopsFile = ./pgdog.env;

        mode = "0400";
        restartUnits = [ "pgdog.service" ];
      };
    };
  };
}