{
  config,
  inputs,
  lib,
  pkgs,
  this,
  ...
}:
{
  imports = [
    inputs.agenix.nixosModules.default
    (lib.mkAliasOptionModule
      [ "secrets" ]
      [
        "age"
        "secrets"
      ]
    )
  ];

  config = {
    age.identityPaths =
      if this.isHeadful then
        [ "${config.my.home}/.ssh/${this.hostname}_ed25519" ]
      else
        config.services.openssh.hostKeys |> lib.filter (x: x.type == "ed25519") |> map (x: x.path);

    environment.systemPackages = with pkgs; [
      age
      agenix
    ];

    nixpkgs.overlays = [ inputs.agenix.overlays.default ];
  };
}