let
  thinkpad = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ2X5hdT9/6BIrRWSE+XBbc4+ocVkPqoAGO2DMSYiJB/";
  nuc = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH6pI2rVvnEMG7oHzA47NRahEKQj99pagrat+Q7pOT2v";
  falkenstein = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJxar1P+KXVPzHCaIcGg33Gvog+a5Z8snHWSFqbY3WC6";
  rouven = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILkxTuzjS3EswMfj+wSKu9ciRyStvjDlDUXzkqEUGDaP";
in
{
  # thinkpad
  "secrets/thinkpad/wireless.age".publicKeys = [ rouven thinkpad ];
  "secrets/thinkpad/tud.age".publicKeys = [ rouven thinkpad ];
  "secrets/thinkpad/agdsn.age".publicKeys = [ rouven thinkpad ];
  "secrets/thinkpad/dyport-auth.age".publicKeys = [ rouven thinkpad ];
  "secrets/thinkpad/wireguard/dorm/private.age".publicKeys = [ rouven thinkpad ];
  "secrets/thinkpad/wireguard/dorm/preshared.age".publicKeys = [ rouven thinkpad ];
  "secrets/thinkpad/borg/passphrase.age".publicKeys = [ rouven thinkpad ];
  "secrets/thinkpad/borg/key.age".publicKeys = [ rouven thinkpad ];

  # nuc
  "secrets/nuc/matrix/shared.age".publicKeys = [ rouven nuc ];
  "secrets/nuc/matrix/sync.age".publicKeys = [ rouven nuc ];
  "secrets/nuc/mautrix-telegram/env.age".publicKeys = [ rouven nuc ];
  "secrets/nuc/vaultwarden.age".publicKeys = [ rouven nuc ];
  "secrets/nuc/mullvad.age".publicKeys = [ rouven nuc ];
  "secrets/nuc/keycloak/db.age".publicKeys = [ rouven nuc ];
  "secrets/nuc/authentik/core.age".publicKeys = [ rouven nuc ];
  "secrets/nuc/authentik/ldap.age".publicKeys = [ rouven nuc ];
  "secrets/nuc/grafana/oidc.age".publicKeys = [ rouven nuc ];
  "secrets/nuc/cache.age".publicKeys = [ rouven nuc ];
  "secrets/nuc/borg/passphrase.age".publicKeys = [ rouven nuc ];
  "secrets/nuc/borg/key.age".publicKeys = [ rouven nuc ];

  # falkenstein
  "secrets/falkenstein/purge.age".publicKeys = [ rouven falkenstein ];
  "secrets/falkenstein/pfersel.age".publicKeys = [ rouven falkenstein ];
  "secrets/falkenstein/wireguard/dorm/private.age".publicKeys = [ rouven falkenstein ];
  "secrets/falkenstein/wireguard/dorm/preshared.age".publicKeys = [ rouven falkenstein ];
  "secrets/falkenstein/borg/passphrase.age".publicKeys = [ rouven falkenstein ];
  "secrets/falkenstein/borg/key.age".publicKeys = [ rouven falkenstein ];
  "secrets/falkenstein/dmarc.age".publicKeys = [ rouven falkenstein ];

  #shared
  "secrets/shared/maxmind.age".publicKeys = [ rouven nuc falkenstein ];
}