{
  sops = {
    defaultSopsFile = ../keys/production.yaml;

    secrets = {
      # Restic
      "restic/local-backups" = {
        owner = "root";
        group = "backup";
        mode = "0440";
      };

      # Turn
      "turn/ssl-key" = {
        owner = "turnserver";
      };
      "turn/ssl-cert" = {
        owner = "turnserver";
      };
    };
  };
}