{ lib, ... }:
{
  # These globally declared secrets belong to services that run only on the
  # server hosts. Root ownership keeps agenix activation independent of users
  # that intentionally do not exist on tnix.
  age.secrets.bindPW.owner = lib.mkForce "root";
  age.secrets.oidcGTS.owner = lib.mkForce "root";
  age.secrets.oidcGTSEnv.owner = lib.mkForce "root";
  age.secrets.oidcHeadscale.owner = lib.mkForce "root";
  age.secrets.traefik.owner = lib.mkForce "root";
  age.secrets.webdav.owner = lib.mkForce "root";
  age.secrets.lldapAdmin.mode = lib.mkForce "400";

  age.secrets.wirelessSecretsFile = {
    file = ../../../secrets/wirelessSecretsFile.age;
    owner = "wpa_supplicant";
  };

  # The pinix access-point passphrase is a standalone hostapd secret.  Keep
  # it root-only here; tnix-wpa-secrets.service converts it into the
  # wpa_supplicant external-password format only at runtime.
  age.secrets.pinixWifi = {
    file = ../../../secrets/pinix-wifi.age;
    owner = "root";
    group = "root";
    mode = "0400";
  };

  age.secrets.headscalePreAuthKey = {
    file = ../../../secrets/headscalePreAuthKey.age;
    owner = "builder";
  };

  age.secrets.pinixHeadscalePreAuthKey = {
    file = ../../../secrets/pinixHeadscalePreAuthKey.age;
    owner = "root";
    mode = "400";
  };

  age.secrets.mailPW = {
    file = ../../../secrets/mailPW.age;
    owner = "builder";
  };
}