{
  config,
  lib,
  namespace,
  ...
}:
let
  user = config.${namespace}.user.name;
  desktopSopsFile = (lib.snowfall.fs.get-file "secrets/desktop-secrets.yaml");
in
{
  # Permission modes are in octal representation (same as chmod),
  # the digits represent: user|group|others
  # 7 - full (rwx)
  # 6 - read and write (rw-)
  # 5 - read and execute (r-x)
  # 4 - read only (r--)
  # 3 - write and execute (-wx)
  # 2 - write only (-w-)
  # 1 - execute only (--x)
  # 0 - none (---)
  # Either a user id or group name representation of the secret owner
  # It is recommended to get the user name from `config.users.users.<?name>.name` to avoid misconfiguration
  # Either the group id or group name representation of the secret group
  # It is recommended to get the group name from `config.users.users.<?name>.group` to avoid misconfiguration
  sops = {
    # ------------------------------
    # Secrets
    # ------------------------------
    secrets = {
      "desktop/hass_token" = {
        sopsFile = desktopSopsFile;
        mode = "0777";
      };
      "desktop/restic/user" = {
        sopsFile = desktopSopsFile;
        mode = "0644";
      };
      "desktop/restic/password" = {
        sopsFile = desktopSopsFile;
        mode = "0600";
      };
      "desktop/restic/repo" = {
        sopsFile = desktopSopsFile;
        mode = "0600";
      };
      # ------------------------------
      # SSH keys
      # ------------------------------
      "ssh-keys-public/desktop-nixos" = {
        mode = "0644";
        owner = config.users.users."${user}".name;
        group = config.users.users."${user}".group;
        restartUnits = [ "sshd.service" ];
      };
      "ssh-keys-private/desktop-nixos" = {
        mode = "0600";
        owner = config.users.users."${user}".name;
        group = config.users.users."${user}".group;
        restartUnits = [ "sshd.service" ];
      };
      "ssh-keys-public/desktop-nixos-root" = {
        path = "/root/.ssh/id_ed25519.pub";
        mode = "0600";
        restartUnits = [ "sshd.service" ];
      };
      "ssh-keys-private/desktop-nixos-root" = {
        path = "/root/.ssh/id_ed25519";
        mode = "0600";
        restartUnits = [ "sshd.service" ];
      };
    };

    # ------------------------------
    # Templates
    # ------------------------------
    templates = {
      "restic.env" = {
        mode = "0600";
        content = ''
          RESTIC_REST_USER=${config.sops.placeholder."desktop/restic/user"}
          RESTIC_REST_PASSWORD=${config.sops.placeholder."desktop/restic/password"}
        '';
        restartUnits = [
          "restic-backups-jallen-nas.service"
          "restic-backups-proton-drive.service"
        ];
      };
    };
  };
}
