{ pkgs, config, ... }:
{
  vault.secrets.cache-secret = {
    secretPath = "hosts/nix-cache01/cache-secret";
    extractKey = "key";
    outputDir = "/run/secrets/cache-secret";
    services = [ "harmonia" ];
  };

  services.harmonia = {
    enable = true;
    package = pkgs.unstable.harmonia;
    signKeyPaths = [ "/run/secrets/cache-secret" ];
  };
  systemd.services.harmonia = {
    environment.RUST_LOG = "info,actix_web=debug";
  };
}