{ keyCommandEnv, ... }:
{
  deployment.keys = {
    "metrics-nekomesh-grafana-admin-password.secret" = {
      keyCommand = keyCommandEnv ++ [ "pass" "metrics-nekomesh/grafana/admin-password" ];
      destDir = "/secrets";
      user = "grafana";
      group = "grafana";
      permissions = "0640";
      uploadAt = "pre-activation";
    };
    "mail-nekomesh-nekover-se.secret" = {
      keyCommand = keyCommandEnv ++ [ "pass" "mail/nekomesh-nekover-se" ];
      destDir = "/secrets";
      user = "grafana";
      group = "grafana";
      permissions = "0640";
      uploadAt = "pre-activation";
    };
  };
}