let
  aqua = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDqUfzu99L7l+V0jcFSMYkECKvnAn3ttE0W6kNA5FrNq";
  users = [ aqua ];

  controlstation = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE21X3txzkrFRP3I5Y+6kinS/IWxRdc+fM4AZvnTJaFR";
  mainsrv = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINEp7Pqhw9bVrK1IViY+zbwjJeuXw/jvKLh7ZFO9tKGY";
  master = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILO2i1lSe3YwTT5fZl6UPXGRdn7HMycDMlYCtVpTAPiu";
  systems = [ controlstation mainsrv master ];


  all = users ++ systems;
in
{
  "iso-master-key.age".publicKeys = [ master controlstation aqua ];
  "iso-master-pub.age".publicKeys = [ master controlstation aqua ];

  "aquakey.age".publicKeys = all;
  "aquakeyp.age".publicKeys = all;
  "aquapwd.age".publicKeys = all;
  "samba.age".publicKeys = all;
  "notifyemailpass.age".publicKeys = all;
  "attic-env.age".publicKeys = all;
  "attic-token.age".publicKeys = all;

  "hermes-env.age".publicKeys = [ master controlstation aqua ];
  
  "frigate.age".publicKeys = [ master mainsrv aqua ];
  "forgejo.age".publicKeys = [ master mainsrv aqua ];
  "forgejodb.age".publicKeys = [ master mainsrv aqua ];
  "hass.age".publicKeys = [ master mainsrv aqua ];
  "invidiouscomp.age".publicKeys = [ master mainsrv aqua ];
  "invidiousdb.age".publicKeys = [ master mainsrv aqua ];
  "immich.age".publicKeys = [ master mainsrv aqua ];
  "immichdb.age".publicKeys = [ master mainsrv aqua ];
  "email-aqua.age".publicKeys = [ master mainsrv aqua ];
  "gluetun.age".publicKeys = [ master mainsrv aqua ];
}