{ config, ... }: {
  age.secrets.go-sendxmpp= {
    file = ../../secrets/go-sendxmpp.age;
    owner = "drone";
    };

  age.secrets.forgejoToken = {
    file = ../../secrets/forgejoToken.age;
    owner = "drone";
    };

  age.secrets.oidcForgejo= {
    file = ../../secrets/oidcForgejo.age;
    mode = "444";
#    owner = "dex";
    };

  age.secrets.webdav= {
    file = ../../secrets/webdav.age;
    owner = "webdav";
    };

  age.secrets.oidcOauth2= {
    file = ../../secrets/oidcOauth2.age;
    };

  age.secrets.oidcGTS= {
    file = ../../secrets/oidcGTS.age;
    owner = "gotosocial";
    };

  # GoToSocial needs the same OIDC secret in systemd EnvironmentFile format.
  age.secrets.oidcGTSEnv = {
    file = ../../secrets/oidcGTSEnv.age;
    owner = "gotosocial";
    };

  age.secrets.oidcHeadscale= {
    file = ../../secrets/oidcHeadscale.age;
    owner = "headscale";
    };

  age.secrets.mailPW= {
    file = ../../secrets/mailPW.age;
    owner = "builder";
    };

  age.secrets.resticPW= {
    file = ../../secrets/resticPW.age;
    };

  age.secrets.domain= {
    file = ../../secrets/domain.age;
    mode = "444";
    };


  age.secrets.bindPW= {
    file = ../../secrets/bindPW.age;
    owner = "prosody";
    name = "${config.domain}.cfg.lua";
    };

  age.secrets.lldapAdmin= {
    file = ../../secrets/lldapAdmin.age;
    mode = "444";
    };

  age.secrets.traefik = {
    file = ../../secrets/dns-challenge.age;
    owner = "traefik";
    path = "/var/lib/traefik/env";
    };
}