{...}: {
  services.secrets = {
    enable = true;
    secrets = {
      restic_password = {
        fetchScript = ''
          simple_get "/private-public-keys/restic/Vault" .password > $secretFile
        '';
      };
      restic_env = {
        fetchScript = ''
          RESTIC_USERNAME=$(simple_get "/api-keys/storage/restic/Vault" .username)
          RESTIC_PASSWORD=$(simple_get "/api-keys/storage/restic/Vault" .password)
          echo "RESTIC_REPOSITORY=rest:https://$RESTIC_USERNAME:$RESTIC_PASSWORD@storage-restic.owo.monster/Vault" > $secretFile
        '';
      };
      wg_priv = {
        fetchScript = ''
          simple_get "/private-public-keys/wireguard/chaos-internal/vault" .private > $secretFile
        '';
      };
      wg_preshared_hetzner-vm = {
        fetchScript = ''
          simple_get "/private-public-keys/wireguard/chaos-internal/vault" .preshared_keys.hetzner_vm > $secretFile
        '';
      };
      wg_preshared_iphone8 = {
        fetchScript = ''
          simple_get "/private-public-keys/wireguard/chaos-internal/vault" .preshared_keys.iphone8 > $secretFile
        '';
      };
      wg_preshared_lappy-t495 = {
        fetchScript = ''
          simple_get "/private-public-keys/wireguard/chaos-internal/vault" ".preshared_keys.lappy_t495" > $secretFile
        '';
      };
    };
  };
}