{
  config,
  inputs,
  lib,
  pkgs,
  this,
  ...
}:
{
  imports = [
    inputs.agenix.nixosModules.default
    (lib.mkAliasOptionModule
      [ "secrets" ]
      [
        "age"
        "secrets"
      ]
    )
  ];

  config = {
    age.identityPaths =
      if this.isHeadful then
        [ "${config.my.home}/.ssh/id_${lib.my.ssh.type}" ]
      else
        config.services.openssh.hostKeys
        |> lib.filter (attr: attr.type == lib.my.ssh.type)
        |> map (attr: attr.path);

    environment.systemPackages = with pkgs; [
      age
      agenix
    ];

    nixpkgs.overlays = [ inputs.agenix.overlays.default ];
  };
}