{ inputs, den, ... }: {
  den.aspects.secrets.nixos = { ... }: {
    imports = [ inputs.sops-nix.nixosModules.sops ];

    sops = {
      defaultSopsFile = ../secrets/secrets.yaml;
      age.keyFile = "/etc/sops/age/keys.txt";

      secrets = {
        "user-password" = {
          neededForUsers = true;
        };
        "ssh-private-key" = {
          path = "/run/secrets/ssh-private-key";
          owner = "zoty";
          mode = "0400";
        };
      };
    };
  };
}