{ inputs, ... }:
{
  imports = [ inputs.sops-nix.nixosModules.sops ];

  sops = {
    defaultSopsFile = ../secrets.yaml;

    # Derive the age key from the systems ssh key. I didn't know this before but
    # it seems like all systems have ssh keys already generated.
    age = {
      sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
      keyFile = "/var/lib/sops-nix/key.txt";
      generateKey = true;
    };

    secrets = {
      "mail/me" = {};
      "jellyfin/zachary" = {};
      "wireguard/crayon" = {};
    };
  };
}