diff --git a/data/default.nix b/data/default.nix
index 45918ea5..5b58c56f 100644
--- a/data/default.nix
+++ b/data/default.nix
@@ -1,4 +1,7 @@
 {
+  imports = [
+    ./oidc.nix
+  ];
   flake.data = {
     hosts = fromTOML (builtins.readFile ./hosts.toml);
     services = fromTOML (builtins.readFile ./services.toml);
diff --git a/data/oidc.nix b/data/oidc.nix
new file mode 100644
index 00000000..15cb8dd7
--- /dev/null
+++ b/data/oidc.nix
@@ -0,0 +1,13 @@
+{
+  self,
+  lib,
+  ...
+}:
+let
+  clientList = lib.concatLists (
+    lib.mapAttrsToList (c: _: (c.config.dish.oidcClients or [ ])) self.nixosConfigurations
+  );
+in
+{
+  flake.data.oidcClients = clientList;
+}
diff --git a/flake.nix b/flake.nix
index a365a543..e2cdc0e3 100644
--- a/flake.nix
+++ b/flake.nix
@@ -130,13 +130,10 @@
         ./hosts
         ./neovim
         ./data
+        # Called fmodule instead of flake-module to clean up autosuggestions
+        (import ./fmodule.nix)
       ];
 
-      # # Flake attributes
-      # flake = {
-      #
-      # };
-
       # Per-system stuff
       perSystem =
         {
diff --git a/fmodule.nix b/fmodule.nix
new file mode 100644
index 00000000..9faf251e
--- /dev/null
+++ b/fmodule.nix
@@ -0,0 +1,10 @@
+{
+  lib,
+  ...
+}:
+{
+  options.flake.data = lib.mkOption {
+    type = lib.types.anything;
+    description = "Data for dishNet flakes";
+  };
+}
diff --git a/lib/default.nix b/lib/default.nix
index 52f08308..32d2b073 100644
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -7,6 +7,7 @@ in
   flake = {
     lib = {
       caddy = import ./caddy.nix { inherit data lib; };
+      secrets = import ./secrets.nix;
       inherit data;
       inherit strings;
       inherit (strings) toPascalCase toUpperSnakeCase;
diff --git a/lib/secrets.nix b/lib/secrets.nix
new file mode 100644
index 00000000..44bf6cfb
--- /dev/null
+++ b/lib/secrets.nix
@@ -0,0 +1,17 @@
+{
+  mkServiceSecrets =
+    service: isDir: secretsPath: secrets:
+    let
+      sep = if isDir then "/" else "-";
+    in
+    builtins.listToAttrs (
+      map (sec: {
+        name = service + "-" + sec;
+        value = {
+          owner = service;
+          group = service;
+          file = secretsPath + /${service}${sep}${sec}.age;
+        };
+      }) secrets
+    );
+}