let
  soispha = "age1mshh4ynzhhzhff25tqwkg4j054g3xwrfznh98ycchludj9wjj48qn2uffn";
  jaki = "age1vuhaey7kd9l76y6f9weeqmde3s4kjw38869ju6u3027yece2r3rqssjxst";

  tiamatHostKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMD87QQIUXdEv3TaNRrI9clD9VgpsuVLFg2CrNGa5lVB";
  apzuHostKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBivF5b6PyxsR/t+4Qg4IEDXHVXrjmZpslTUNXpvcVbO";

  server2HostKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL1TUFoCTplkqTVbXQ6qDCyeo2h8+C0vjrIlKu6vmq5f";
  server3HostKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP3s4FjGx7LEVf/GE3WeCl8TmCtPt8gW1J0mp0fUJBNm";

  # WARNING(@bpeetz): ONLY use this key on age files that are meant to be public! <2025-02-23>
  testingKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILxdvBk/PC9fC7B5vqe9TvygZKY6LgDQ2mXRdVrthBM/";

  publicKeys = {
    "tiamat" = [
      soispha
      tiamatHostKey
    ];
    "apzu" = [
      soispha
      apzuHostKey
    ];

    "server2" = [
      soispha
      jaki
      server2HostKey
    ];
    "server3" = [
      soispha
      jaki
      server3HostKey
    ];
  };

  sources = import ./unflake.nix;
  extra_lib = sources.library.nixLib;
  pkgs-unstable = sources.nixpkgs-unstable.legacyPackages."x86_64-linux";
  inherit (pkgs-unstable) lib;

  secrets = let
    base = extra_lib.mkByName {
      useShards = false;
      fileName = "secrets";
      baseDirectory = ./hosts/by-name;
    };
    secrets = builtins.mapAttrs (name: value:
      extra_lib.mkByName {
        relativePaths = true;
        useShards = false;
        fileRegex = "^.*\\.age$";
        baseDirectory = value;
      })
    base;
    allSecretPaths = builtins.mapAttrs (serverName: secrets:
      lib.lists.flatten (
        lib.attrsets.mapAttrsToList
        (service: fileNames: builtins.map (fileName: "./hosts/by-name/${serverName}/secrets/${service}/${fileName}") fileNames)
        secrets
      ))
    secrets;
  in
    # We should be able to merge with the `//` operator here because all attribute paths
    # must be unique (they were files previously)
    builtins.foldl' (acc: elem: acc // elem) {} (
      builtins.attrValues (builtins.mapAttrs (serverName: secretPaths:
        builtins.listToAttrs (
          builtins.map
          (secretPath: {
            name = secretPath;
            value.publicKeys = publicKeys."${serverName}";
          })
          secretPaths
        ))
      allSecretPaths)
    );
in
  secrets
  // {
    "tests/common/email/dkim/alice.com/private.age".publicKeys = [soispha jaki testingKey];
    "tests/common/email/dkim/bob.com/private.age".publicKeys = [soispha jaki testingKey];
    "tests/common/email/dkim/mail1.server.com/private.age".publicKeys = [soispha jaki testingKey];
    "tests/common/email/dkim/mail2.server.com/private.age".publicKeys = [soispha jaki testingKey];
    "./tests/by-name/ro/rocie/secrets/login.age".publicKeys = [soispha jaki testingKey];
  }