let
  # SYSTEMS
  m3-ares = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG+M4CygEQ29eTmLqgyIAFCxy0rgfO23klNiARBEA+3s";
  m3-kratos = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDl+LtFGsk/A7BvxwiUCyq5wjRzGtQSrBJzzLGxINF4O";
  m3-helios = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIyHuLITpI+M45ZZem33wDusY2X988mBoWpD1HDeZNRJ";
  m3-atlas = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFmmqZ4GgDEXJgj8uYrZAr/EoLIA6LJGkTIyKGQD/60a";
  m3-hermes = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOXJ5y9u88KptDaG959Aj6eq0CCBePOw1SvEh/84wb4M";

  # USERS
  m3ta-adm = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKCTBFMPCOpKerJBlcvH44602sGyJvgXrwYUegYf96D0";
  sascha.koenig = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEZbg/Z9mnflXuLahGY8WOSBMqbgeqVIkIwRkquys1Ml";
  users = [m3ta-adm sascha.koenig];

  systems = [m3-atlas m3-ares m3-helios m3-kratos m3-hermes];
in {
  "secrets/anytype-key.age".publicKeys = systems ++ users;
  "secrets/anytype-key-ares.age".publicKeys = systems ++ users;
  "secrets/authentik-env.age".publicKeys = systems ++ users;
  "secrets/baserow-env.age".publicKeys = systems ++ users;
  "secrets/ghost-env.age".publicKeys = systems ++ users;
  "secrets/littlelink-m3tam3re.age".publicKeys = systems ++ users;
  "secrets/m3tam3re-secrets.age".publicKeys = systems ++ users;
  "secrets/kestra-config.age".publicKeys = systems ++ users;
  "secrets/kestra-env.age".publicKeys = systems ++ users;
  "secrets/minio-root-cred.age".publicKeys = systems ++ users;
  "secrets/rustfs-env.age".publicKeys = systems ++ users;
  "secrets/n8n-env.age".publicKeys = systems ++ users;
  "secrets/netbird-auth-secret.age".publicKeys = systems ++ users;
  "secrets/netbird-db-password.age".publicKeys = systems ++ users;
  "secrets/netbird-encryption-key.age".publicKeys = systems ++ users;
  "secrets/netbird-dashboard-env.age".publicKeys = systems ++ users;
  "secrets/netbird-server-env.age".publicKeys = systems ++ users;
  "secrets/netbird-proxy-env.age".publicKeys = systems ++ users;
  "secrets/paperless-key.age".publicKeys = systems ++ users;
  "secrets/ref-key.age".publicKeys = systems ++ users;
  "secrets/exa-key.age".publicKeys = systems ++ users;
  "secrets/basecamp-client-id.age".publicKeys = systems ++ users;
  "secrets/basecamp-client-secret.age".publicKeys = systems ++ users;
  "secrets/gitea-runner-token.age".publicKeys = systems ++ users;
  "secrets/honcho-selfhost-db-password.age".publicKeys = systems ++ users;
  "secrets/honcho-selfhost-env.age".publicKeys = systems ++ users;
  "secrets/honcho-selfhost-jwt-secret.age".publicKeys = systems ++ users;
  "secrets/outline-key.age".publicKeys = systems ++ users;
  "secrets/restreamer-env.age".publicKeys = systems ++ users;
  "secrets/searx.age".publicKeys = systems ++ users;
  "secrets/tailscale-key.age".publicKeys = systems ++ users;
  "secrets/traefik.age".publicKeys = systems ++ users;
  "secrets/vaultwarden-env.age".publicKeys = systems ++ users;
  "secrets/wg-DE.age".publicKeys = systems ++ users;
  "secrets/wg-NL.age".publicKeys = systems ++ users;
  "secrets/wg-NO.age".publicKeys = systems ++ users;
  "secrets/wg-US.age".publicKeys = systems ++ users;
  "secrets/wg-BR.age".publicKeys = systems ++ users;
  "secrets/honcho-key.age".publicKeys = systems ++ users;
  "secrets/hermes-env.age".publicKeys = systems ++ users;
  "secrets/hermes-cloud-env.age".publicKeys = systems ++ users;
  "secrets/hermes-api-server-key.age".publicKeys = systems ++ users;
  "secrets/hermes-gitea-token.age".publicKeys = systems ++ users;
  "secrets/tuwunel-registration-token.age".publicKeys = systems ++ users;
}