{ ... }:

{
  sops.age.keyFile = "/persist/keys/host-age.key";

  sops.secrets.user-password = {
    sopsFile = ../secrets/user-password.yaml;
    neededForUsers = true;
  };
}