nixos/modules/secrets.nix1 filter=git-crypt diff=git-crypt