let
  root = "age1nxwgdy3p9fft0zsae440wyulknf5rk82s0wnxssrpxu4nezysa4qexcvpl";
  fcuny = "age1keyvdhpspgqp4g5zjthdphau5q5qlt6fs0ex0wqnve66dmup9pzqn4sakj";
  backup = "age1fh4960rdrk4d7m4c5lwd3trvw9ylk09dvucj2gd2udy7d5cz2a0svcqws6";
  all = [ root fcuny backup ];
in
{
  "wireguard_privatekey.age".publicKeys = all;

  "acme/credentials.age".publicKeys = all;
  "acme/gcp_service_account.json.age" = {
    publicKeys = all;
    owner = "acme";
  };

  "syncthing/key.age" = {
    publicKeys = all;
    owner = "fcuny";
  };

  "syncthing/cert.age" = {
    publicKeys = all;
    owner = "fcuny";
  };

  "unifi/unifi-poller.age" = {
    publicKeys = all;
    owner = "unpoller-exporter";
  };

  "gandi/apikey.age" = {
    publicKeys = all;
    owner = "acme";
  };

  "restic/repo-systems.age".publicKeys = all;
  "rsync.net/ssh-key.age".publicKeys = all;

  "sendsms/config.age".publicKeys = all;
}