{
  inputs,
  pkgs,
  flake,
  config,
  lib,
  ...
}: let
  cfg = config.pim.sops;
in {
  imports = [inputs.sops-nix.nixosModules.sops];
  options.pim.sops.enable = lib.mkEnableOption "sops";

  config = lib.mkIf cfg.enable {
    environment.systemPackages = with pkgs; [sops];

    sops = {
      age.keyFile = "/home/pim/.config/sops/age/keys.txt";
      defaultSopsFile = "${flake}/secrets/secrets.yaml";
    };
  };
}