{ lib, ... }:

{
  age.secrets.agentXmpp = {
    file = ../../../secrets/agentXmpp.age;
    owner = "drone";
  };

  age.secrets.builderXmpp = {
    file = ../../../secrets/builderXmpp.age;
    owner = "drone";
  };

  # These globally declared secrets belong to services that run only on pinix.
  # Keep the unused blunix copies root-owned so agenix activation does not
  # depend on service users that intentionally do not exist on this host.
  age.secrets.bindPW.owner = lib.mkForce "root";
  age.secrets.mailPW.owner = lib.mkForce "root";
  age.secrets.oidcGTS.owner = lib.mkForce "root";
  age.secrets.oidcGTSEnv.owner = lib.mkForce "root";
  age.secrets.webdav.owner = lib.mkForce "root";
  age.secrets.lldapAdmin.mode = lib.mkForce "400";

  # Dex reads these files as root while preparing its runtime configuration.
  age.secrets.oidcVikunja.file = ../../../secrets/oidcVikunja.age;
  age.secrets.oidcAudiobookshelf.file = ../../../secrets/oidcAudiobookshelf.age;
  age.secrets.oidcQuantum.file = ../../../secrets/oidcQuantum.age;

  age.secrets.oauth2Cookie.file = ../../../secrets/oauth2Cookie.age;

  age.secrets.traefikBasicAuth = {
    file = ../../../secrets/traefikBasicAuth.age;
    owner = "traefik";
  };
}