{ config, ... }:
{
  sops = {
    # sometimes the impermanence bind mount is stopped when sops needs these
    age.sshKeyPaths = [
      "${config.custom.impermanence.persistPath}/etc/ssh/ssh_host_ed25519_key"
      "${config.custom.impermanence.persistPath}/etc/ssh/ssh_host_rsa_key"
    ];
    defaultSopsFile = ./../../secrets/common.yaml;
    secrets = {
      kopia = {
        sopsFile = ./../../secrets/${config.networking.hostName}.yaml;
      };
    };
  };
}