{
  config,
  lib,
  pkgs,
  inputs,
  lib',
  osConfig ? null,
  ...
}:

let
  cfg = config.secrets;
  sops = lib'.sopsAvailability config osConfig;
  standalone = !sops.osAvailable;

  sopsDir = "${toString inputs.nix-secrets}/secrets";
in
{
  imports = [ ./vault.nix ];

  options.secrets = {
    enable = lib.mkEnableOption "secrets";

    vault = {
      enable = lib.mkEnableOption "vault CLI";
    };

    files = lib.mkOption {
      type = lib.types.attrsOf (lib.types.listOf lib.types.str);
      default = { };
      example = {
        taskwarrior = [ "sync-server-url" ];
      };
      description = "Keys to decrypt, grouped by the sops file that holds them.";
    };

    templates = lib.mkOption {
      type = lib.types.attrsOf (
        lib.types.submodule {
          options = {
            path = lib.mkOption {
              type = lib.types.nullOr lib.types.str;
              default = null;
              description = "Where to render the template, relative to the home directory.";
            };
            content = lib.mkOption {
              type = lib.types.str;
              description = "Template body; interpolate keys with `config.sops.placeholder`.";
            };
          };
        }
      );
      default = { };
      description = "Secret-bearing templates to render; declare their keys in `secrets.files`.";
    };

    path = lib.mkOption {
      type = lib.types.attrsOf lib.types.str;
      readOnly = true;
      description = "Decrypted secret paths, keyed by `<file>/<key>`.";
    };

    templatePath = lib.mkOption {
      type = lib.types.attrsOf lib.types.str;
      readOnly = true;
      description = "Rendered template paths, keyed by template name.";
    };
  };

  config = lib.mkMerge [
    {
      secrets.path = lib.optionalAttrs sops.available (
        lib.mapAttrs (_: secret: secret.path) sops.secrets
      );

      secrets.templatePath = lib.optionalAttrs sops.available (
        lib.mapAttrs (_: template: template.path) sops.templates
      );
    }
    (lib.mkIf cfg.enable (
      lib.optionalAttrs standalone {
        sops = {
          secrets = lib'.mkSopsSecrets sopsDir null cfg.files;

          templates = lib.mapAttrs (
            _: t:
            {
              inherit (t) content;
            }
            // lib.optionalAttrs (t.path != null) {
              path = "${config.home.homeDirectory}/${t.path}";
            }
          ) cfg.templates;
        };
      }
      // {
        home.packages = [
          pkgs.age
          pkgs.age-plugin-yubikey
          pkgs.sops
        ];

        warnings = lib.optional (
          !sops.available && (cfg.files != { } || cfg.templates != { })
        ) "secrets are declared, but sops is unavailable; they will not be decrypted or rendered.";
      }
    ))
  ];
}