{ lib, ... }:

{
  age.secrets.agentXmpp = {
    file = ../../../secrets/agentXmpp.age;
    owner = "drone";
  };

  age.secrets.builderXmpp = {
    file = ../../../secrets/builderXmpp.age;
    owner = "drone";
  };

  age.secrets.agentCalendarPw = {
    file = ../../../secrets/agentCalendarPw.age;
    owner = "drone";
  };

  # Shared by board-agent-worker (review/research/split) and
  # agent-codex-builder -- both already run as "drone", so one runtime copy
  # is enough (unlike the orgaCalendarPw/orgaMailPw split above, which
  # exists specifically to keep separate Unix users from sharing a path).
  age.secrets.openrouterApiKey = {
    file = ../../../secrets/openrouterApiKey.age;
    owner = "drone";
  };

  # Separate runtime copies keep the Orga clients away from credentials.
  # Only the dedicated network services can read these paths.
  age.secrets.orgaCalendarPw = {
    file = ../../../secrets/agentCalendarPw.age;
    owner = "orga-calendar-read";
  };

  age.secrets.orgaMailPw = {
    file = ../../../secrets/mailPW.age;
    owner = "orga-mail-read";
  };

  # Same underlying credential as orgaMailPw (same mail@lukasrosier.com
  # account) -- a separate runtime copy for the write-scoped mail-draft
  # service, mirroring the orgaCalendarPw/orgaCalendarWritePw split.
  age.secrets.orgaMailDraftPw = {
    file = ../../../secrets/mailPW.age;
    owner = "orga-mail-draft";
  };

  # Full-admin Radicale write capability -- same underlying credential as
  # orgaCalendarPw/agentCalendarPw (the "calendar" LDAP identity), a
  # separate runtime copy for the dedicated orga-calendar-write service
  # user. See the rights rule "05-calendar-admin-full-access" in
  # hosts/pinix/localServices/calendar/radicale.nix for why this identity
  # is now admin-capable across all collections, not just calendar/public.
  age.secrets.orgaCalendarWritePw = {
    file = ../../../secrets/agentCalendarPw.age;
    owner = "orga-calendar-write";
  };

  # These globally declared secrets belong to services that run only on pinix.
  # Keep the unused blunix copies root-owned so agenix activation does not
  # depend on service users that intentionally do not exist on this host.
  # bindPW is the exception: Prosody now runs on blunix too (see
  # hosts/blunix/localServices/prosody/setup-prosody.nix), which reads it
  # directly as its own LDAP bind config include, so it keeps the
  # `owner = "prosody"` from the global declaration instead of being forced
  # to root here.
  age.secrets.mailPW.owner = lib.mkForce "root";
  age.secrets.oidcGTS.owner = lib.mkForce "root";
  age.secrets.oidcGTSEnv.owner = lib.mkForce "root";
  age.secrets.webdav.owner = lib.mkForce "root";
  age.secrets.lldapAdmin.mode = lib.mkForce "400";

  age.secrets.pinixHeadscalePreAuthKey = {
    file = ../../../secrets/pinixHeadscalePreAuthKey.age;
    owner = "root";
    mode = "400";
  };

  # Dex reads these files as root while preparing its runtime configuration.
  age.secrets.oidcVikunja.file = ../../../secrets/oidcVikunja.age;
  age.secrets.oidcAudiobookshelf.file = ../../../secrets/oidcAudiobookshelf.age;
  age.secrets.oidcQuantum.file = ../../../secrets/oidcQuantum.age;
  age.secrets.oidcTrek.file = ../../../secrets/oidcTrek.age;

  age.secrets.oauth2Cookie.file = ../../../secrets/oauth2Cookie.age;

  age.secrets.traefikBasicAuth = {
    file = ../../../secrets/traefikBasicAuth.age;
    owner = "traefik";
  };

  # Prosody's motd, included by hosts/blunix/localServices/prosody/
  # setup-prosody.nix. Global secretFiles.nix doesn't declare this one
  # (only pinix's now-fallback localServices/secrets.nix did), so it
  # needs the same owner/name override here after the move.
  age.secrets.motd = {
    file = ../../../secrets/motd.age;
    name = "motd.cfg.lua";
    owner = "prosody";
  };
}