{ lib, config, ... }:
let
  inputs = config.inputInjection.flake-inputs;
in
{
  sops = {
    age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
    defaultSopsFile = lib.mkDefault toString (./. + "/hosts/${config.networking.hostname}/secrets.ini");
    defaultSopsFormat = "yaml"; # is the default. ini had some template rendering issues in practice
  };
}