{ pkgs, config, ... }:
{
  sops.secrets."cache-secret" = {
    sopsFile = ../../secrets/nix-cache01/cache-secret;
    format = "binary";
  };

  services.harmonia = {
    enable = true;
    package = pkgs.unstable.harmonia;
    signKeyPaths = [ config.sops.secrets.cache-secret.path ];
  };
  systemd.services.harmonia = {
    environment.RUST_LOG = "info,actix_web=debug";
  };
}