{
  lib,
  inputs,
  config,
  myUtils,
  ...
}:

let
  cfg = config.secrets;
  inherit (cfg) sopsDir;
  owner = config.users.users.${cfg.username}.name;
  mkSopsSecrets = myUtils.mkSopsSecrets sopsDir;
in
{
  imports = [ inputs.sops-nix.nixosModules.sops ];

  options = {
    secrets = {
      username = lib.mkOption {
        type = lib.types.str;
      };

      sopsDir = lib.mkOption {
        type = lib.types.str;
        default = "${toString inputs.nix-secrets}/secrets";
      };

      nixSigningKey = {
        enable = lib.mkEnableOption "nix signing key configuration";
        name = lib.mkOption {
          type = lib.types.str;
          default = "${config.host.name}-nix-signing-key";
        };
      };
    };
  };

  config = {
    sops = {
      age.keyFile = "/home/${cfg.username}/.config/sops/age/keys.txt";

      secrets = lib.mkMerge [
        (mkSopsSecrets "email" [ "personal" "work" ] { inherit owner; })
        (lib.mkIf cfg.nixSigningKey.enable (
          mkSopsSecrets cfg.nixSigningKey.name [ cfg.nixSigningKey.name ] { inherit owner; }
        ))
      ];
    };

    nix.settings.secret-key-files = lib.mkIf cfg.nixSigningKey.enable [
      config.sops.secrets."${cfg.nixSigningKey.name}/${cfg.nixSigningKey.name}".path
    ];
  };
}