nixos/common/secrets.nix