{
  self,
  inputs,
  ...
}: {
  flake.nixosModules.secrets = {
    config,
    lib,
    pkgs,
    ...
  }: {
    imports = [inputs.sops-nix.nixosModules.sops];

    sops = {
      age.keyFile = "/etc/sops/age/keys.txt";
      defaultSopsFile = ../../../secrets/secrets.yaml;

      secrets = {
        lidarr-api-key = {};
        gitea-db-passwd = {};
        immich-api-key = {};
        immich-db-passwd = {};
        immich-postgres-passwd = {};
        mail-relay-user = {};
        mail-relay-passwd = {};
        silverbullet-user = {};
      };
      templates = {
        "gitea.env".content = ''
          GITEA__database__PASSWD=${config.sops.placeholder.gitea-db-passwd}
          MYSQL_PASSWORD=${config.sops.placeholder.gitea-db-passwd}
          MYSQL_ROOT_PASSWORD=${config.sops.placeholder.gitea-db-passwd}
        '';
        "immich.env".content = ''
          DB_PASSWORD=${config.sops.placeholder.immich-db-passwd}
          IMMICH_API_KEY=${config.sops.placeholder.immich-api-key}
          POSTGRES_PASSWORD=${config.sops.placeholder.immich-postgres-passwd}
        '';
        "mail.env".content = ''
          RELAY_USER=${config.sops.placeholder.mail-relay-user}
          RELAY_PASSWORD=${config.sops.placeholder.mail-relay-passwd}
        '';
        "silverbullet.env".content = ''
          SB_USER=${config.sops.placeholder.silverbullet-user}
        '';
      };
    };
  };
}