{ keyCommandEnv, ... }:
{
  deployment.keys = {
    "mastodon-secret-key-base.secret" = {
      keyCommand = keyCommandEnv ++ [ "pass" "mastodon/secret-key-base" ];
      destDir = "/secrets";
      user = "mastodon";
      group = "mastodon";
      permissions = "0640";
      uploadAt = "pre-activation";
    };
    "mastodon-otp-secret.secret" = {
      keyCommand = keyCommandEnv ++ [ "pass" "mastodon/otp-secret" ];
      destDir = "/secrets";
      user = "mastodon";
      group = "mastodon";
      permissions = "0640";
      uploadAt = "pre-activation";
    };
    "mastodon-vapid-private-key.secret" = {
      keyCommand = keyCommandEnv ++ [ "pass" "mastodon/vapid-private-key" ];
      destDir = "/secrets";
      user = "mastodon";
      group = "mastodon";
      permissions = "0640";
      uploadAt = "pre-activation";
    };
    "mastodon-email-smtp-pass.secret" = {
      keyCommand = keyCommandEnv ++ [ "pass" "mastodon/email-smtp-pass" ];
      destDir = "/secrets";
      user = "mastodon";
      group = "mastodon";
      permissions = "0640";
      uploadAt = "pre-activation";
    };
    "mastodon-keycloak-client-secret.secret" = {
      keyCommand = keyCommandEnv ++ [ "pass" "mastodon/keycloak-client-secret" ];
      destDir = "/secrets";
      user = "mastodon";
      group = "mastodon";
      permissions = "0640";
      uploadAt = "pre-activation";
    };
    "mastodon-active-record-encryption-primary-key.secret" = {
      keyCommand = keyCommandEnv ++ [ "pass" "mastodon/active-record-encryption-primary-key" ];
      destDir = "/secrets";
      user = "mastodon";
      group = "mastodon";
      permissions = "0640";
      uploadAt = "pre-activation";
    };
    "mastodon-active-record-encryption-key-derivation-salt.secret" = {
      keyCommand = keyCommandEnv ++ [ "pass" "mastodon/active-record-encryption-key-derivation-salt" ];
      destDir = "/secrets";
      user = "mastodon";
      group = "mastodon";
      permissions = "0640";
      uploadAt = "pre-activation";
    };
    "mastodon-active-record-encryption-deterministic-key.secret" = {
      keyCommand = keyCommandEnv ++ [ "pass" "mastodon/active-record-encryption-deterministic-key" ];
      destDir = "/secrets";
      user = "mastodon";
      group = "mastodon";
      permissions = "0640";
      uploadAt = "pre-activation";
    };
  };
}