{ ... }:
{
  deployment.keys."matrix-registration-shared-secret.secret" = {
    keyCommand = [ "env" "GNUPGHOME=/home/yuri/.passinfra_gnupg" "PASSWORD_STORE_DIR=/home/yuri/pass/infra" "pass" "matrix/registration-shared-secret" ];
    destDir = "/secrets";
    user = "matrix-synapse";
    group = "matrix-synapse";
    permissions = "0640";
    uploadAt = "pre-activation";
  };
  deployment.keys."matrix-turn-shared-secret.secret" = {
    keyCommand = [ "env" "GNUPGHOME=/home/yuri/.passinfra_gnupg" "PASSWORD_STORE_DIR=/home/yuri/pass/infra" "pass" "matrix/turn-shared-secret" ];
    destDir = "/secrets";
    user = "matrix-synapse";
    group = "matrix-synapse";
    permissions = "0640";
    uploadAt = "pre-activation";
  };
  deployment.keys."matrix-email-smtp-pass.secret" = {
    keyCommand = [ "env" "GNUPGHOME=/home/yuri/.passinfra_gnupg" "PASSWORD_STORE_DIR=/home/yuri/pass/infra" "pass" "matrix/email-smtp-pass" ];
    destDir = "/secrets";
    user = "matrix-synapse";
    group = "matrix-synapse";
    permissions = "0640";
    uploadAt = "pre-activation";
  };
  deployment.keys."matrix-homeserver-signing-key.secret" = {
    keyCommand = [ "env" "GNUPGHOME=/home/yuri/.passinfra_gnupg" "PASSWORD_STORE_DIR=/home/yuri/pass/infra" "pass" "matrix/homeserver-signing-key" ];
    destDir = "/secrets";
    user = "matrix-synapse";
    group = "matrix-synapse";
    permissions = "0640";
    uploadAt = "pre-activation";
  };
  deployment.keys."matrix-SYNCV3_SECRET.secret" = {
    keyCommand = [ "env" "GNUPGHOME=/home/yuri/.passinfra_gnupg" "PASSWORD_STORE_DIR=/home/yuri/pass/infra" "pass" "matrix/SYNCV3_SECRET" ];
    destDir = "/secrets";
    user = "matrix-synapse";
    group = "matrix-synapse";
    permissions = "0640";
    uploadAt = "pre-activation";
  };
}