let
  APPA = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGvQbYHiB17BfsvHBgPYJN50Th+da+rtbsTIjOSaT+1Y root@APPA";
  gandalf_at_appa = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFrE1fMXjJXI8f1mKvhLquwSsb4tvLh5Tq0n+yOakQks gandalf@appa.dryb.com";

  T430 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGPQKzUqdLY58tFTB5zOeiTjbbrDvHA1speD/Rg6oOfz root@T430";
  IROH = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFYiK3Dl8QvAZfY7Cl1OlF9aXKa/an32mtrCNkavlSNG root@IROH";

  gandalf = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAOG8Sja2i6nepkEkuxYdu86XbT9vS5uniBmZifSMZ0t jacob.bachmann@posteo.de";

  users = [
    gandalf_at_appa
    gandalf
  ];

  systems = [
    APPA
    T430
    IROH
  ];

  clients = [
    T430
    IROH
  ];

in
{
  "environments/acme.age".publicKeys = users ++ [ APPA ];
  "environments/vaultwarden.age".publicKeys = users ++ [ APPA ];
  "keys/wireguard/dryborg/privatekey.age".publicKeys = [ gandalf ] ++ clients;
  "keys/wireguard/dryborg/presharedkey.age".publicKeys = [ gandalf ] ++ clients;
  "passwords/gitea/db.age".publicKeys = users ++ [ APPA ];
  "passwords/anki/admin.age".publicKeys = users ++ [ APPA ];
  "passwords/nextcloud/admin.age".publicKeys = users ++ [ APPA ];
  "passwords/ddclient/cloudflare.age".publicKeys = users ++ [ APPA ];
}