{lib, ...}: {
  config = {
    age.secrets = {
      secret0.file = ./secrets/secret0.age;
      secret1.file = ./secrets/secret1.age;
      secret2.file = ./secrets/secret2.age;
    };
    pub-keys = {
      ssh = {
        andromeda = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJy2VD362wUcu0lKj2d6OIU8dbAna0Lu/NaAYIj8gdIA andromeda@lenovo";
        lenovo = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHG4eqsLTq2os2mxfwhys3BpVnowcJrqt2CbRFzN2pJb root@lenovo";
      };
    };
  };
  options = {
    pub-keys.ssh = lib.mkOption {
      type = lib.types.attrsOf lib.types.str;
      default = {};
      description = "set of public keys as `name = key`";
    };
  };
}