{ config, ... }:
{
  sops.secrets."cache-secret" = {
    sopsFile = ../../secrets/nix-cache01/cache-secret;
    format = "binary";
  };

  services.harmonia = {
    enable = true;
    signKeyPaths = [ config.sops.secrets.cache-secret.path ];
  };
}