rec {
  deployment = {
    secrets = {
      "ristretto-signing-key" = {
        # source = ... fill this in ...
        destination = "/run/keys/ristretto.signing-key";
        owner.user = "root";
        owner.group = "root";
        permissions = "0400";
        action = ["sudo" "systemctl" "restart" "zkapissuer.service"];
      };
      "stripe-secret-key" = {
        # source = ... fill this in ...
        destination = "/run/keys/stripe.secret-key";
        owner.user = "root";
        owner.group = "root";
        permissions = "0400";
        action = ["sudo" "systemctl" "restart" "zkapissuer.service"];
      };

      "monitoringvpn-secret-key" = {
        # source = ... fill this in ...
        destination = "/run/keys/monitoringvpn/client.key";
        owner.user = "root";
        owner.group = "root";
        permissions = "0400";
        action = ["sudo" "systemctl" "restart" "wireguard-monitoringvpn.service"];
      };
      "monitoringvpn-preshared-key" = {
        # source = ... fill this in ...
        destination = "/run/keys/monitoringvpn/preshared.key";
        owner.user = "root";
        owner.group = "root";
        permissions = "0400";
        action = ["sudo" "systemctl" "restart" "wireguard-monitoringvpn.service"];
      };
    };
  };

  imports = [
    ../../nixos/modules/issuer.nix
    ../../nixos/modules/monitoring/vpn/client.nix
    ../../nixos/modules/monitoring/exporters/node.nix
  ];

  services.private-storage = {
    # sshUsers = ...
    monitoring.vpn.client = {
      # enable = ...
      # ip = ...
      # endpoint = ...
      # endpointPublicKeyFile = ...
    };
  };
  services.private-storage-issuer = {
    enable = true;
    tls = true;
    ristrettoSigningKeyPath = deployment.secrets.ristretto-signing-key.destination;
    stripeSecretKeyPath = deployment.secrets.stripe-secret-key.destination;
    database = "SQLite3";
    databasePath = "/var/db/vouchers.sqlite3";
    # letsEncryptAdminEmail = ...;
    # domains = ...;
    # allowedChargeOrigins = ...;
  };

  # system.stateVersion = ...
}