{ inputs
, ...
}:

{
  imports = [
    inputs.sops-nix.nixosModules.sops
  ];

  sops = {
    defaultSopsFile = ../../secrets/default.yaml;
    defaultSopsFormat = "yaml";

    gnupg.sshKeyPaths = [ ];
    age.sshKeyPaths = [
      "/persist/etc/ssh/ssh_host_ed25519_key"
    ];

    secrets = {
      "users/admin/password_hash" = {
        owner = "admin";
        neededForUsers =  true;
      };
      "users/kurisu/password_hash" = {
        owner = "kurisu";
        neededForUsers =  true;
      };

      "forgejo/admin/dokkae.cat/password" = {
        owner = "forgejo";
        group = "forgejo";
        mode = "400";
      };
      "forgejo/mailer/password" = {
        owner = "forgejo";
        group = "forgejo";
        mode = "400";
      };
    };
  };
}