{ config, ... }:
let
  user = "nix-apps";
in
{
  # Permission modes are in octal representation (same as chmod),
  # the digits represent: user|group|others
  # 7 - full (rwx)
  # 6 - read and write (rw-)
  # 5 - read and execute (r-x)
  # 4 - read only (r--)
  # 3 - write and execute (-wx)
  # 2 - write only (-w-)
  # 1 - execute only (--x)
  # 0 - none (---)
  # Either a user id or group name representation of the secret owner
  # It is recommended to get the user name from `config.users.users.<?name>.name` to avoid misconfiguration
  # Either the group id or group name representation of the secret group
  # It is recommended to get the group name from `config.users.users.<?name>.group` to avoid misconfiguration
  sops = {
    defaultSopsFile = ../../secrets/nuc-secrets.yaml;
    age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];

    # ------------------------------
    # Secrets
    # ------------------------------
    secrets = {
      
      "wifi" = {
        sopsFile = ../../secrets/secrets.yaml;
      };

      # ------------------------------
      # Secureboot keys
      # ------------------------------

      "secureboot/GUID" = {
        sopsFile = ../../secrets/secrets.yaml;
        path = "/etc/secureboot/GUID";
        mode = "0640";
      };
      "secureboot/keys/db-key" = {
        sopsFile = ../../secrets/secrets.yaml;
        path = "/etc/secureboot/keys/db/db.key";
        mode = "0640";
      };
      "secureboot/keys/db-pem" = {
        sopsFile = ../../secrets/secrets.yaml;
        path = "/etc/secureboot/keys/db/db.pem";
        mode = "0640";
      };
      "secureboot/keys/KEK-key" = {
        sopsFile = ../../secrets/secrets.yaml;
        path = "/etc/secureboot/keys/KEK/KEK.key";
        mode = "0640";
      };
      "secureboot/keys/KEK-pem" = {
        sopsFile = ../../secrets/secrets.yaml;
        path = "/etc/secureboot/keys/KEK/KEK.pem";
        mode = "0640";
      };
      "secureboot/keys/PK-key" = {
        sopsFile = ../../secrets/secrets.yaml;
        path = "/etc/secureboot/keys/PK/PK.key";
        mode = "0640";
      };
      "secureboot/keys/PK-pem" = {
        sopsFile = ../../secrets/secrets.yaml;
        path = "/etc/secureboot/keys/PK/PK.pem";
        mode = "0640";
      };
    };

    # ------------------------------
    # Templates
    # ------------------------------
    templates = {
      #
    };
  };
}