{config, lib, ...}:
{
  # These secrets are declared globally but their services run on other hosts.
  # Keep their pinix copies root-owned so missing service users do not make
  # activation fail.
  age.secrets.mailPW.owner = lib.mkForce "root";
  age.secrets.oidcHeadscale.owner = lib.mkForce "root";
  age.secrets.traefik.owner = lib.mkForce "root";
  age.secrets.lldapAdmin.group = "radicale";
  age.secrets.lldapAdmin.mode = lib.mkForce "440";

  # Vikunja receives this root-owned file through systemd credentials.
  age.secrets.oidcVikunja.file = ../../../secrets/oidcVikunja.age;

  age.secrets.motd = {
    file = ../../../secrets/motd.age;
    name = "motd.cfg.lua";
    owner = "prosody";
    };

  age.secrets.headscalePreAuthKey = {
    file = ../../../secrets/headscalePreAuthKey.age;
    owner = "drone";
    };

 age.secrets.wirelessSecretsFile = {
    file = ../../../secrets/wirelessSecretsFile.age;
    owner = "drone";
    };
}