{
  config,
  lib,
  system,
  namespace,
  ...
}:
let
  cfg = config.${namespace}.sops;
  defaultSops = lib.snowfall.fs.get-file "secrets/secrets.yaml";
  isx86 = system == "x86_64-linux";
  user = config.${namespace}.user.name;
in
{
  config = lib.mkIf cfg.enable {
    sops = {
      defaultSopsFile = if cfg.defaultSopsFile != null then cfg.defaultSopsFile else defaultSops;
      age.sshKeyPaths = cfg.sshKeyPaths;

      secrets = {
        "wifi" = { };

        "matt_password" = {
          neededForUsers = true;
          mode = "0600";
          owner = config.users.users."${user}".name;
          group = config.users.users."${user}".group;
        };

        "disk-key".mode = "0600";

        "secureboot/GUID" = lib.mkIf isx86 { mode = "0600"; };
        "secureboot/keys/db-key" = lib.mkIf isx86 { mode = "0600"; };
        "secureboot/keys/db-pem" = lib.mkIf isx86 { mode = "0600"; };
        "secureboot/keys/KEK-key" = lib.mkIf isx86 { mode = "0600"; };
        "secureboot/keys/KEK-pem" = lib.mkIf isx86 { mode = "0600"; };
        "secureboot/keys/PK-key" = lib.mkIf isx86 { mode = "0600"; };
        "secureboot/keys/PK-pem" = lib.mkIf isx86 { mode = "0600"; };
      };

      templates = { };
    };
  };
}