{ config, ... }:
{
  services.tide = {
    enable = true;
    secretFiles = {
      adminPassword = config.sops.secrets."tide-admin-password".path;
      mailPassword = config.sops.secrets."tide-mail-password".path;
      secretKeyBase = config.sops.secrets."tide-secret-key-base".path;
      borgPassphrase = config.sops.secrets."borg-passphrase".path;
      borgPrivateKey = config.sops.secrets."borg-private-key".path;
    };
  };

  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
  sops.age.sshKeyPaths = [ ];
  sops.gnupg.sshKeyPaths = [ ];

  sops.secrets = {
    "tide-admin-password" = {
      sopsFile = ./secrets/tide.yaml;
      key = "admin-password";
      mode = "0400";
      owner = "discourse";
      group = "discourse";
    };
    "tide-mail-password" = {
      sopsFile = ./secrets/tide.yaml;
      key = "mail-key";
      mode = "0400";
      owner = "discourse";
      group = "discourse";
    };
    "tide-secret-key-base" = {
      sopsFile = ./secrets/tide.yaml;
      key = "secret-key";
      mode = "0400";
      owner = "discourse";
      group = "discourse";
    };
  };
}