let
  tnix = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILrZETtzrSfkomL9H31SuyQJ8O39ujMIjsCkbjL4DgxM";
  root = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICb7MnxZch2IfxkFhKjGWkAVeAENJFEFaMk91UQTiQBf";
  root2 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ6v2CMRHS50Wq5cAqWenwkV8GNONFIDbKpW4ChfptUc";
  users = [ tnix root root2 ];

  blunix = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBKr9V1HzAAFJ+6sjtrrkq8/qM9DFQq2gNUvbIB5Jn2C";
  pinix = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBTIBiB9JYYtViI1IKK96pH+x3D63BQQgmZstc8jPBNp";
  systems = [ blunix pinix ];
in
{
  "dns-challenge.age".publicKeys = users ++ systems;
  "domain.age".publicKeys = users ++ systems;
  "lldapAdmin.age".publicKeys = users ++ systems;
  "bindPW.age".publicKeys = users ++ systems;
  "oidcHeadscale.age".publicKeys = users ++ systems;
  "webdav.age".publicKeys = users ++ systems;
  "go-sendxmpp.age".publicKeys = users ++ systems;
  "oidcForgejo.age".publicKeys = users ++ systems;
  "oidcGTS.age".publicKeys = users ++ systems;
  "oidcGTSEnv.age".publicKeys = users ++ systems;
  "oidcVikunja.age".publicKeys = users ++ systems;
  "oidcAudiobookshelf.age".publicKeys = users ++ systems;
  "oidcQuantum.age".publicKeys = users ++ systems;
  "oidcTrek.age".publicKeys = users ++ systems;
  "oidcOauth2.age".publicKeys = users ++ systems;
  "oauth2Cookie.age".publicKeys = users ++ systems;
  "traefikBasicAuth.age".publicKeys = users ++ systems;
  "traefikDashboardPassword.age".publicKeys = users;
  "mailPW.age".publicKeys = users ++ systems;
  "ipv4.age".publicKeys = users ++ systems;
  "ipv6.age".publicKeys = users ++ systems;
  "motd.age".publicKeys = users ++ systems;
  "wirelessSecretsFile.age".publicKeys = users ++ systems;
  "pinix-wifi.age".publicKeys = users ++ [ pinix ];
  "pinixLldapAdmin.age".publicKeys = users ++ [ pinix ];
  # Reusable key for the main blunix, tnix and pinix nodes. It enrolls them
  # under the single Headscale user `lukas`; the technical pinix-dns node has
  # its own short-lived key and account.
  "pinixHeadscalePreAuthKey.age".publicKeys = users ++ systems;
  "resticPW.age".publicKeys = users ++ systems;
  "headscalePreAuthKey.age".publicKeys = users ++ systems;
  "agentXmpp.age".publicKeys = users ++ systems;
  "builderXmpp.age".publicKeys = users ++ systems;
  "financeXmpp.age".publicKeys = users ++ systems;
  "forgejoToken.age".publicKeys = users ++ systems;
  "agentCalendarPw.age".publicKeys = users ++ systems;
  "icecastPw.age".publicKeys = users ++ systems;
  "openrouterApiKey.age".publicKeys = users ++ systems;
  "liveIntentOpenaiApiKey.age".publicKeys = users ++ [ pinix ];
  "bindAcmeTsig.age".publicKeys = users ++ systems;
}