{
  config,
  inputs,
  lib,
  pkgs,
  this,
  ...
}:
with lib;
{
  imports = [
    inputs.agenix.nixosModules.default
    (mkAliasOptionModule
      [ "secrets" ]
      [
        "age"
        "secrets"
      ]
    )
  ];

  config = {
    age.identityPaths =
      if this.isHeadful then
        [ "${config.my.home}/.ssh/id_${my.ssh.type}" ]
      else
        map (attr: attr.path) (filter (attr: attr.type == my.ssh.type) config.services.openssh.hostKeys);

    environment.systemPackages = with pkgs; [
      age
      agenix
    ];

    nixpkgs.overlays = [ inputs.agenix.overlays.default ];
  };
}