{
  sops = {
    defaultSopsFile = ./../../secrets/secrets.yaml;
    # sometimes the impermanence bind mount is stopped when sops needs these
    age.sshKeyPaths = [
      "/persist/etc/ssh/ssh_host_ed25519_key"
      "/persist/etc/ssh/ssh_host_rsa_key"
    ];
  };
}