{
  config,
  inputs,
  lib,
  pkgs,
  this,
  ...
}:
with lib; {
  imports = [(mkAliasOptionModule ["secrets"] ["age" "secrets"])];

  config = {
    age.identityPaths =
      if this.isHeadful
      then ["${config.my.home}/.ssh/id_${my.ssh.type}"]
      else
        map (attr: attr.path) (filter (attr: attr.type == my.ssh.type)
          config.services.openssh.hostKeys);

    environment.systemPackages = with pkgs; [agenix];

    nixpkgs.overlays = [inputs.agenix.overlays.default];
  };
}