let
  #SYSTEMS
  AZ-CLD-1 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIItSijmU5YwcJcoshtmYxpxBaVA4TPaCMk23ws7KDkAH";
  AZ-LT-NIX = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIg/nFOPx763xIbepPsdYRE49R7HwvikXhLF/iPgH1Jh";
  AZ-PRM-1 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID6gl9maUQ99I4t8mCAdfUw6lrA9NYx2EbwqGOmKts+l";

  # ── Thin Client Fleet Hosts ───────────────────────────────────────
  # SSH host keys (ed25519) are generated on first boot of each host.
  # After first boot, retrieve via: ssh-keyscan -t ed25519 AZ-TC-NN.netbird
  # and paste the public key here. Until then, the corresponding .age
  # secrets can't be decrypted by the host.
  AZ-TC-01 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5PLACEHOLDER-REPLACE-WITH-REAL-HOSTKEY-01";
  AZ-TC-02 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5PLACEHOLDER-REPLACE-WITH-REAL-HOSTKEY-02";
  AZ-TC-03 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5PLACEHOLDER-REPLACE-WITH-REAL-HOSTKEY-03";

  #USERS
  sascha.koenig = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEZbg/Z9mnflXuLahGY8WOSBMqbgeqVIkIwRkquys1Ml";
  jannik.mueller = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPvZazSuIoWoRWhkAqQDMLeurxVUyy1MTllp1wfw1tzq";

  users = [sascha.koenig jannik.mueller];
  systems = [AZ-CLD-1 AZ-LT-NIX AZ-PRM-1];
  thinClients = [AZ-TC-01 AZ-TC-02 AZ-TC-03];
in {
  "secrets/elevenlabs-key.age".publicKeys = systems ++ users;
  "secrets/exa-key.age".publicKeys = systems ++ users;
  "secrets/kestractl-env.age".publicKeys = systems ++ users;
  "secrets/outline-key.age".publicKeys = systems ++ users;
  "secrets/ref-key.age".publicKeys = systems ++ users;
  "secrets/sascha.koenig-secrets.age".publicKeys = [AZ-LT-NIX sascha.koenig];

  # ── Per-host Thin Client secrets ──────────────────────────────────
  # Each Thin Client needs:
  #   - <host>-krb5-keytab.age          — AD machine keytab
  #   - <host>-netbird-setupkey.age     — NetBird setup key
  #   - <host>-wifi-client-cert.age     — WiFi EAP-TLS client cert (PEM, key+cert)
  #   - <host>-rustdesk-password.age    — RustDesk permanent password
  # Plus a shared one for all thin clients:
  #   - rustdesk-psk.age                — RustDesk pre-shared key
  #
  # Create with: agenix -e secrets/AZ-TC-01-krb5-keytab.age

  # Shared RustDesk PSK — readable by all thin clients
  "secrets/rustdesk-psk.age".publicKeys = thinClients ++ users;

  # Per-host Thin Client secrets
  "secrets/AZ-TC-01-krb5-keytab.age".publicKeys = [AZ-TC-01] ++ users;
  "secrets/AZ-TC-01-netbird-setupkey.age".publicKeys = [AZ-TC-01] ++ users;
  "secrets/AZ-TC-01-wifi-client-cert.age".publicKeys = [AZ-TC-01] ++ users;
  "secrets/AZ-TC-01-rustdesk-password.age".publicKeys = [AZ-TC-01] ++ users;

  "secrets/AZ-TC-02-krb5-keytab.age".publicKeys = [AZ-TC-02] ++ users;
  "secrets/AZ-TC-02-netbird-setupkey.age".publicKeys = [AZ-TC-02] ++ users;
  "secrets/AZ-TC-02-wifi-client-cert.age".publicKeys = [AZ-TC-02] ++ users;
  "secrets/AZ-TC-02-rustdesk-password.age".publicKeys = [AZ-TC-02] ++ users;

  "secrets/AZ-TC-03-krb5-keytab.age".publicKeys = [AZ-TC-03] ++ users;
  "secrets/AZ-TC-03-netbird-setupkey.age".publicKeys = [AZ-TC-03] ++ users;
  "secrets/AZ-TC-03-wifi-client-cert.age".publicKeys = [AZ-TC-03] ++ users;
  "secrets/AZ-TC-03-rustdesk-password.age".publicKeys = [AZ-TC-03] ++ users;
}