use agenix

hosts/freun.dev/default.nix

@@ -4,5 +4,6 @@
     ./hardware-configuration.nix
     ./configuration.nix
     ./services.nix
+    ./secrets.nix
   ];
 }

hosts/freun.dev/secrets.nix

@@ -0,0 +1,22 @@
+{ lib, config, ... }:
+{
+  age.secrets = lib.listToAttrs
+    (
+      map (secret: { name = secret; value = { file = ../../secrets/${secret}.age; }; }) [
+        "gotosocial"
+        "hastebin-tokens"
+        "immich"
+        "storage-box-credentials"
+        "vaultwarden"
+      ]
+    ) // {
+    smtp-password = {
+      file = ../../secrets/smtp-password.age;
+      owner =
+        if (config.services.grafana.enable) then
+          config.systemd.services.grafana.serviceConfig.User
+        else
+          "root";
+    };
+  };
+}