{lib, ...}: let
  ntfyGrafanaWebhookSecret = ../../secrets/ntfy-grafana-webhook.age;
in {
  age = {
    secrets =
      {
        azion-env = {
          file = ../../secrets/azion-env.age;
        };
        grafana-admin-pw = {
          file = ../../secrets/grafana-admin-pw.age;
          owner = "grafana";
        };
        grafana-db-password = {
          file = ../../secrets/grafana-db-password.age;
          owner = "grafana";
        };
        grafana-secret-key = {
          file = ../../secrets/grafana-secret-key.age;
          owner = "grafana";
        };
        monitoring-loki-htpasswd = {
          file = ../../secrets/monitoring-loki-htpasswd.age;
          owner = "traefik";
          mode = "0400";
        };
        traefik-env = {
          file = ../../secrets/traefik-env.age;
        };
        kestra-config = {
          file = ../../secrets/kestra-config.age;
          mode = "644";
        };
        kestra-env = {file = ../../secrets/kestra-env.age;};
        kestra-secrets = {file = ../../secrets/kestra-secrets.age;};
        n8n-env = {
          file = ../../secrets/n8n-env-prm.age;
        };
        n8n-runner-auth-token = {
          file = ../../secrets/n8n-runner-auth-token-prm.age;
        };
        pgadmin-pw = {
          file = ../../secrets/pgadmin-pw.age;
          owner = "pgadmin";
        };
        pg-cert = {
          file = ../../secrets/server.crt.age;
          owner = "postgres";
          group = "postgres";
          mode = "0644";
        };
        pg-key = {
          file = ../../secrets/server.key.age;
          owner = "postgres";
          group = "postgres";
          mode = "0600";
        };
        smb-autoablage = {
          file = ../../secrets/smb-autoablage.age;
        };
      }
      // lib.optionalAttrs (builtins.pathExists ntfyGrafanaWebhookSecret) {
        ntfy-grafana-webhook = {
          file = ntfyGrafanaWebhookSecret;
          mode = "0400";
        };
      };
  };
}