{
  config,
  inputs,
  lib,
  pkgs,
  this,
  ...
}:
with lib;
{
  imports = [
    inputs.agenix.nixosModules.default
    (mkAliasOptionModule [ "secrets" ] [
      "age"
      "secrets"
    ])
  ];

  config = {
    age.identityPaths =
      if this.isHeadful then
        [ "${config.my.home}/.ssh/id_${my.ssh.type}" ]
      else
        map (attr: attr.path) (filter (attr: attr.type == my.ssh.type) config.services.openssh.hostKeys);

    environment.systemPackages = with pkgs; [ agenix ];

    nixpkgs.overlays = [ inputs.agenix.overlays.default ];
  };
}