diff --git a/.sops.yaml b/.sops.yaml
index a0912e8..b5d0211 100644
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -1,18 +1,96 @@
 keys:
   - &admin_age_fi age1tf38ae8yzzzmtjp5cjyemf0a8cksq62dz0x0hsntyhsjk5pq6s6q3v9nm7
   - &host_age_coturn age1vnrtarxwmqxflh2sxe2s49ldfzkve268hx62x4ltv38h3emv8dqspu028l
+  - &host_age_forgejo age1d5y8dx3e8pksvxr8fv8f02v0y7qg7kuwpxpmxksp7xlvrcpfju5sdz6guk
   - &host_age_ikiwiki age1st5axcrn2s09effsjp6gl89rnwd967y007pzpzamlqydrpf7yeeqjwtnx0
+  - &host_age_jellyfin age10huhyn3va02zjysyanf8fd6lpfvjv3k3u6qymanz9jtcmfp3kqfskth7yt
+  - &host_age_keycloak age15kluaw2krucmc0j98zfk0s5tkwqer0ax6jva458zukzrgnqjqc9q7s88yd
+  - &host_age_lifeline age1pmx78vda0c2qnn8epvkavl26e2939uj65608fdq959ds60d58ucsqwxsua
+  - &host_age_mail-1 age1hny8kwx0uymselgas25q558ruxxdv7lgtu9d5rnd6x9w3nysk4zqumzzrp
+  - &host_age_mastodon age1r60mmmeulm33h0trc0y870dml5hzhglyjv4wecyjy2858pg8u47s793r30
+  - &host_age_matrix age1g60l5mu08xrwfw7uptwcwde8kp9dacs4ltqv2ndjskpy8z5sqakqssxxq5
+  - &host_age_metrics age1lrtengtdc0nzpagr8fkp5mwqda66jqr0s2h3wsxcdscmalp8n3js3r0e3n
+  - &host_age_metrics-nekomesh age1rh7zgp445t39c7tmh84r30e9edju8gmtn84u7rjwhmyntzkugucq5x0xse
+  - &host_age_nextcloud age1lvlmct30jtg7p4qpf8evtjlld6g74q2ckh803hd3ynr7cz7zlceq84flwu
+  - &host_age_searx age17h3js5v8s5vezcankky6kqxcrvtfxanmvhp3axmnqs4y9s2lr9yqvc6zrn
+  - &host_age_torrent age1m37wtvp7fpavaygn2jc6kq2gtuvgvf0jgwwhd3p5862djv5segqs97mg7c
+  - &host_age_valkyrie age1guqc5pnajp2whkla6vws4yqnpe5hq4z89w6te3n5yql5pugzfqlqczjlee
 creation_rules:
   - path_regex: config/hosts/coturn/.*
     key_groups:
       -  age:
           - *admin_age_fi
           - *host_age_coturn
+  - path_regex: config/hosts/forgejo/.*
+    key_groups:
+      -  age:
+          - *admin_age_fi
+          - *host_age_forgejo
   - path_regex: config/hosts/ikiwiki/.*
     key_groups:
       -  age:
           - *admin_age_fi
           - *host_age_ikiwiki
+  - path_regex: config/hosts/jellyfin/.*
+    key_groups:
+      -  age:
+          - *admin_age_fi
+          - *host_age_jellyfin
+  - path_regex: config/hosts/keycloak/.*
+    key_groups:
+      -  age:
+          - *admin_age_fi
+          - *host_age_keycloak
+  - path_regex: config/hosts/lifeline/.*
+    key_groups:
+      -  age:
+          - *admin_age_fi
+          - *host_age_lifeline
+  - path_regex: config/hosts/mail-1/.*
+    key_groups:
+      -  age:
+          - *admin_age_fi
+          - *host_age_mail-1
+  - path_regex: config/hosts/mastodon/.*
+    key_groups:
+      -  age:
+          - *admin_age_fi
+          - *host_age_mastodon
+  - path_regex: config/hosts/matrix/.*
+    key_groups:
+      -  age:
+          - *admin_age_fi
+          - *host_age_matrix
+  - path_regex: config/hosts/metrics/.*
+    key_groups:
+      -  age:
+          - *admin_age_fi
+          - *host_age_metrics
+  - path_regex: config/hosts/metrics-nekomesh/.*
+    key_groups:
+      -  age:
+          - *admin_age_fi
+          - *host_age_metrics-nekomesh
+  - path_regex: config/hosts/nextcloud/.*
+    key_groups:
+      -  age:
+          - *admin_age_fi
+          - *host_age_nextcloud
+  - path_regex: config/hosts/searx/.*
+    key_groups:
+      -  age:
+          - *admin_age_fi
+          - *host_age_searx
+  - path_regex: config/hosts/torrent/.*
+    key_groups:
+      -  age:
+          - *admin_age_fi
+          - *host_age_torrent
+  - path_regex: config/hosts/valkyrie/.*
+    key_groups:
+      -  age:
+          - *admin_age_fi
+          - *host_age_valkyrie
 stores:
   yaml:
     indent: 2
diff --git a/config/hosts/forgejo/default.nix b/config/hosts/forgejo/default.nix
index d71bcad..7de3a33 100644
--- a/config/hosts/forgejo/default.nix
+++ b/config/hosts/forgejo/default.nix
@@ -5,5 +5,6 @@
     ./forgejo.nix
     ./redis.nix
     ./nginx.nix
+    ./sops.nix
   ];
 }
diff --git a/config/hosts/forgejo/sops.nix b/config/hosts/forgejo/sops.nix
new file mode 100644
index 0000000..78dc2c8
--- /dev/null
+++ b/config/hosts/forgejo/sops.nix
@@ -0,0 +1,6 @@
+{ ... }:
+{
+  sops = {
+    defaultSopsFile = ./secrets.yaml;
+  };
+}
diff --git a/config/hosts/jellyfin/default.nix b/config/hosts/jellyfin/default.nix
index 33e2290..70a20a7 100644
--- a/config/hosts/jellyfin/default.nix
+++ b/config/hosts/jellyfin/default.nix
@@ -5,5 +5,6 @@
     ./hardware-configuration.nix
     ./jellyfin.nix
     ./nginx.nix
+    ./sops.nix
   ];
 }
diff --git a/config/hosts/jellyfin/sops.nix b/config/hosts/jellyfin/sops.nix
new file mode 100644
index 0000000..78dc2c8
--- /dev/null
+++ b/config/hosts/jellyfin/sops.nix
@@ -0,0 +1,6 @@
+{ ... }:
+{
+  sops = {
+    defaultSopsFile = ./secrets.yaml;
+  };
+}
diff --git a/config/hosts/keycloak/default.nix b/config/hosts/keycloak/default.nix
index 6289ce6..83d170e 100644
--- a/config/hosts/keycloak/default.nix
+++ b/config/hosts/keycloak/default.nix
@@ -4,5 +4,6 @@
     ./configuration.nix
     ./keycloak.nix
     ./nginx.nix
+    ./sops.nix
   ];
 }
diff --git a/config/hosts/keycloak/sops.nix b/config/hosts/keycloak/sops.nix
new file mode 100644
index 0000000..78dc2c8
--- /dev/null
+++ b/config/hosts/keycloak/sops.nix
@@ -0,0 +1,6 @@
+{ ... }:
+{
+  sops = {
+    defaultSopsFile = ./secrets.yaml;
+  };
+}
diff --git a/config/hosts/lifeline/default.nix b/config/hosts/lifeline/default.nix
index 9d284a8..36dea6d 100644
--- a/config/hosts/lifeline/default.nix
+++ b/config/hosts/lifeline/default.nix
@@ -3,5 +3,6 @@
   imports = [
     ./configuration.nix
     ./hardware-configuration.nix
+    ./sops.nix
   ];
 }
diff --git a/config/hosts/lifeline/sops.nix b/config/hosts/lifeline/sops.nix
new file mode 100644
index 0000000..78dc2c8
--- /dev/null
+++ b/config/hosts/lifeline/sops.nix
@@ -0,0 +1,6 @@
+{ ... }:
+{
+  sops = {
+    defaultSopsFile = ./secrets.yaml;
+  };
+}
diff --git a/config/hosts/mail-1/default.nix b/config/hosts/mail-1/default.nix
index 5537841..28a5bdc 100644
--- a/config/hosts/mail-1/default.nix
+++ b/config/hosts/mail-1/default.nix
@@ -3,5 +3,6 @@
   imports = [
     ./configuration.nix
     ./simple-nixos-mailserver.nix
+    ./sops.nix
   ];
 }
diff --git a/config/hosts/mail-1/sops.nix b/config/hosts/mail-1/sops.nix
new file mode 100644
index 0000000..78dc2c8
--- /dev/null
+++ b/config/hosts/mail-1/sops.nix
@@ -0,0 +1,6 @@
+{ ... }:
+{
+  sops = {
+    defaultSopsFile = ./secrets.yaml;
+  };
+}
diff --git a/config/hosts/mastodon/default.nix b/config/hosts/mastodon/default.nix
index 5651eb8..5166081 100644
--- a/config/hosts/mastodon/default.nix
+++ b/config/hosts/mastodon/default.nix
@@ -5,5 +5,6 @@
     ./mastodon.nix
     ./opensearch.nix
     ./nginx.nix
+    ./sops.nix
   ];
 }
diff --git a/config/hosts/mastodon/sops.nix b/config/hosts/mastodon/sops.nix
new file mode 100644
index 0000000..78dc2c8
--- /dev/null
+++ b/config/hosts/mastodon/sops.nix
@@ -0,0 +1,6 @@
+{ ... }:
+{
+  sops = {
+    defaultSopsFile = ./secrets.yaml;
+  };
+}
diff --git a/config/hosts/mastodon/yarn.patch b/config/hosts/mastodon/yarn.patch
deleted file mode 100644
index 82a2f77..0000000
--- a/config/hosts/mastodon/yarn.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-diff --git a/.yarnrc.yml b/.yarnrc.yml
---- a/.yarnrc.yml
-+++ b/.yarnrc.yml
-@@ -1 +1,6 @@
- nodeLinker: node-modules
-+
-+approvedGitRepositories:
-+  - "**"
-+
-+enableScripts: true
-diff --git a/yarn.lock b/yarn.lock
---- a/yarn.lock
-+++ b/yarn.lock
-@@ -2,6 +2,6 @@
- # Manual changes might be lost - proceed with caution!
- 
- __metadata:
--  version: 8
-+  version: 9
-   cacheKey: 10c0
- 
\ No newline at end of file
diff --git a/config/hosts/matrix/default.nix b/config/hosts/matrix/default.nix
index c6cd79a..8dbb1ac 100644
--- a/config/hosts/matrix/default.nix
+++ b/config/hosts/matrix/default.nix
@@ -8,5 +8,6 @@
     ./matrix-authentication-service.nix
     ./matrix-synapse.nix
     ./nginx.nix
+    ./sops.nix
   ];
 }
diff --git a/config/hosts/matrix/sops.nix b/config/hosts/matrix/sops.nix
new file mode 100644
index 0000000..78dc2c8
--- /dev/null
+++ b/config/hosts/matrix/sops.nix
@@ -0,0 +1,6 @@
+{ ... }:
+{
+  sops = {
+    defaultSopsFile = ./secrets.yaml;
+  };
+}
diff --git a/config/hosts/metrics-nekomesh/default.nix b/config/hosts/metrics-nekomesh/default.nix
index c2d39a4..cc0af5c 100644
--- a/config/hosts/metrics-nekomesh/default.nix
+++ b/config/hosts/metrics-nekomesh/default.nix
@@ -6,5 +6,6 @@
     ./neo4j.nix
     ./prometheus.nix
     ./nginx.nix
+    ./sops.nix
   ];
 }
diff --git a/config/hosts/metrics-nekomesh/sops.nix b/config/hosts/metrics-nekomesh/sops.nix
new file mode 100644
index 0000000..78dc2c8
--- /dev/null
+++ b/config/hosts/metrics-nekomesh/sops.nix
@@ -0,0 +1,6 @@
+{ ... }:
+{
+  sops = {
+    defaultSopsFile = ./secrets.yaml;
+  };
+}
diff --git a/config/hosts/metrics/default.nix b/config/hosts/metrics/default.nix
index ef5c25c..ea9bd08 100644
--- a/config/hosts/metrics/default.nix
+++ b/config/hosts/metrics/default.nix
@@ -5,5 +5,6 @@
     ./grafana.nix
     ./prometheus.nix
     ./nginx.nix
+    ./sops.nix
   ];
 }
diff --git a/config/hosts/metrics/sops.nix b/config/hosts/metrics/sops.nix
new file mode 100644
index 0000000..78dc2c8
--- /dev/null
+++ b/config/hosts/metrics/sops.nix
@@ -0,0 +1,6 @@
+{ ... }:
+{
+  sops = {
+    defaultSopsFile = ./secrets.yaml;
+  };
+}
diff --git a/config/hosts/nextcloud/default.nix b/config/hosts/nextcloud/default.nix
index 9677aef..5c78b7a 100644
--- a/config/hosts/nextcloud/default.nix
+++ b/config/hosts/nextcloud/default.nix
@@ -4,5 +4,6 @@
     ./configuration.nix
     ./hardware-configuration.nix
     ./nextcloud.nix
+    ./sops.nix
   ];
 }
diff --git a/config/hosts/nextcloud/sops.nix b/config/hosts/nextcloud/sops.nix
new file mode 100644
index 0000000..78dc2c8
--- /dev/null
+++ b/config/hosts/nextcloud/sops.nix
@@ -0,0 +1,6 @@
+{ ... }:
+{
+  sops = {
+    defaultSopsFile = ./secrets.yaml;
+  };
+}
diff --git a/config/hosts/searx/default.nix b/config/hosts/searx/default.nix
index ee2a678..ab8d68f 100644
--- a/config/hosts/searx/default.nix
+++ b/config/hosts/searx/default.nix
@@ -4,5 +4,6 @@
     ./configuration.nix
     ./nginx.nix
     ./searx.nix
+    ./sops.nix
   ];
 }
diff --git a/config/hosts/searx/sops.nix b/config/hosts/searx/sops.nix
new file mode 100644
index 0000000..78dc2c8
--- /dev/null
+++ b/config/hosts/searx/sops.nix
@@ -0,0 +1,6 @@
+{ ... }:
+{
+  sops = {
+    defaultSopsFile = ./secrets.yaml;
+  };
+}
diff --git a/config/hosts/torrent/default.nix b/config/hosts/torrent/default.nix
index dc6a854..d10522c 100644
--- a/config/hosts/torrent/default.nix
+++ b/config/hosts/torrent/default.nix
@@ -7,5 +7,6 @@
     ./radarr.nix
     ./sonarr.nix
     ./nginx.nix
+    ./sops.nix
   ];
 }
diff --git a/config/hosts/torrent/sops.nix b/config/hosts/torrent/sops.nix
new file mode 100644
index 0000000..78dc2c8
--- /dev/null
+++ b/config/hosts/torrent/sops.nix
@@ -0,0 +1,6 @@
+{ ... }:
+{
+  sops = {
+    defaultSopsFile = ./secrets.yaml;
+  };
+}
diff --git a/config/hosts/valkyrie/default.nix b/config/hosts/valkyrie/default.nix
index 68a1b85..1f91238 100644
--- a/config/hosts/valkyrie/default.nix
+++ b/config/hosts/valkyrie/default.nix
@@ -5,5 +5,6 @@
     ./nginx.nix
     ./containers/uptime-kuma
     ./services.nix
+    ./sops.nix
   ];
 }
diff --git a/config/hosts/valkyrie/sops.nix b/config/hosts/valkyrie/sops.nix
new file mode 100644
index 0000000..78dc2c8
--- /dev/null
+++ b/config/hosts/valkyrie/sops.nix
@@ -0,0 +1,6 @@
+{ ... }:
+{
+  sops = {
+    defaultSopsFile = ./secrets.yaml;
+  };
+}