{
  pkgs,
  config,
  ...
}:
{
  _module.args = {
    sec = config.sops.secrets;
  };

  environment.systemPackages = with pkgs; [
    sops
  ];

  sops = {
    defaultSopsFile = ./../secrets/common.yaml;
    age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
  };
}