let
  aqua = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDqUfzu99L7l+V0jcFSMYkECKvnAn3ttE0W6kNA5FrNq";
  users = [ aqua ];

  controlstation = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE21X3txzkrFRP3I5Y+6kinS/IWxRdc+fM4AZvnTJaFR";
  mainsrv = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINEp7Pqhw9bVrK1IViY+zbwjJeuXw/jvKLh7ZFO9tKGY";
  aquaticTest = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIgoR4cTOGZtQDUMKGeDSrr1QPTNlrZ2r7V7dKcX4bLT";
  systems = [ controlstation mainsrv aquaticTest ];


  all = users ++ systems;
in
{
  "aquakey.age".publicKeys = all;
  "aquakeyp.age".publicKeys = all;
  "samba.age".publicKeys = all;
  "notifyemailpass.age".publicKeys = all;

  "frigate.age".publicKeys = [ mainsrv aqua ];
  "forgejo.age".publicKeys = [ mainsrv aqua ];
  "forgejodb.age".publicKeys = [ mainsrv aqua ];
  "watchtower.age".publicKeys = [ mainsrv aqua ];
  "hass.age".publicKeys = [ mainsrv aqua ];
  "invidiouscomp.age".publicKeys = [ mainsrv aqua ];
  "invidiousdb.age".publicKeys = [ mainsrv aqua ];
  "immich.age".publicKeys = [ mainsrv aqua ];
  "immichdb.age".publicKeys = [ mainsrv aqua ];
  "email-aqua.age".publicKeys = [ mainsrv aqua ];
  "email-ntfy.age".publicKeys = [ mainsrv aqua ];
  "email-cert.age".publicKeys = [ mainsrv aqua ];
  "email-key.age".publicKeys = [ mainsrv aqua ];
  "gluetun.age".publicKeys = [ mainsrv aqua ];
}