{ config, ... }:

{
  age.secrets = {
    # authelia
    authelia-jwt.file = ./authelia/jwt.age;
    authelia-storage.file = ./authelia/storage.age;
    authelia-session.file = ./authelia/session.age;
    authelia-oidc-issuer-privatekey-pem.file = ./authelia/oidc-issuer-privatekey-pem.age;
    authelia-oidc-issuer-privatekey-crt.file = ./authelia/oidc-issuer-privatekey-crt.age;

    # lldap
    lldap-admin-user-pass.file = ./lldap/admin-user-pass.age;
    lldap-bind-user-pass = {
      file = ./lldap/bind-user-pass.age;
      group = "secrets-lldap-bind-user-pass";
      mode = "0440";
    };
    lldap-bind-user-pass-hedgedoc-env.file = ./lldap/bind-user-pass-hedgedoc-env.age;

    # mumble
    murmur-env.file = ./murmur/env.age;
    murmur-superpassword.file = ./murmur/superpassword.age;
  };

  users.groups.secrets-lldap-bind-user-pass = {};
}