{ ... }:
{
  sops = {
    age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
    defaultSopsFile = ../../secrets/credentials.json;
    secrets = {
      # FIXME: using mode 444 here is a hack so that spotifyd can cat the
      # values out, but it obviously exposes the secrets to anyone that knows
      # they are there. A better solution would be to override the spotifyd
      # module to make the systemd service run the program with a group, and
      # then give read priviledges to only that group.
      #      "spotify/password" = {
      #        mode = "444";
      #      };
      #      "spotify/username" = {
      #        mode = "444";
      #      };
      "irc/libera-password" = { };
    };
  }; # end of sops
}