nix-infra/config/hosts/netbox/secrets.nix

{ keyCommandEnv, ... }:
{
  deployment.keys."netbox-secret-key.secret" = {
    keyCommand = keyCommandEnv ++ [ "pass" "netbox/secret-key" ];
    destDir = "/secrets";
    user = "netbox";
    group = "netbox";
    permissions = "0640";
    uploadAt = "pre-activation";
  };
}