{ inputs, den, config, ... }:
let
  username = config.local.identity.username;
in {
  den.aspects.secrets.nixos = { ... }: {
    imports = [ inputs.sops-nix.nixosModules.sops ];

    sops = {
      defaultSopsFile = ../secrets/secrets.yaml;

      # Place your age keys at /etc/sops/age/keys.txt before deploying.
      # See README.md for setup instructions.
      age.keyFile = "/etc/sops/age/keys.txt";

      secrets = {
        "user-password" = {
          neededForUsers = true;
        };

        "ssh-private-key" = {
          path  = "/home/${username}/.ssh/id_ed25519";
          owner = username;
          mode  = "0400";
        };
      };
    };
  };
}