{ config, ... }:

{
  imports = [
    ./all
    ./garage
  ];

  sops = {
    useSystemdActivation = true;
    age.keyFile = "/root/.config/sops/age/keys.txt";

    defaultSopsFile = ./snowcloud/example.yaml;

    secrets = {
      wireguard_key = {
        format = "binary";
        sopsFile = ./snowcloud/wireguard.key;

        mode = "0400";
        owner = "systemd-network";
      };

      snow-den_snowlab = {
        format = "binary";
        sopsFile = ./psk/snow-den_snowlab.key;

        mode = "0400";
        owner = "systemd-network";
      };

      snow-den_snowflake = {
        format = "binary";
        sopsFile = ./psk/snow-den_snowflake.key;

        mode = "0400";
        owner = "systemd-network";
      };

      knotmirror_env = {
        format = "dotenv";
        sopsFile = ./snowcloud/knotmirror.env;

        mode = "0400";
        restartUnits = [ "knotmirror.service" ];
      };

      pgpass = {
        format = "binary";
        sopsFile = ./snowcloud/pgpass.conf;

        mode = "0400";
        owner = "postgres";
        path = "${config.services.postgresql.dataDir}/.pgpass";
        restartUnits = [ "pgdog.service" ];
      };

      murmur_env = {
        format = "dotenv";
        sopsFile = ./snowcloud/murmur.env;

        mode = "0400";
        restartUnits = [ "murmur.service" ];
      };
    };
  };
}