{ keyCommandEnv, ... }:
{
  deployment.keys = {
    "wireguard-mail-2-wg0-privatekey.secret" = {
      keyCommand = keyCommandEnv ++ [ "pass" "wireguard/mail-2-wg0-privatekey" ];
      destDir = "/secrets";
      user = "root";
      group = "systemd-network";
      permissions = "0640";
      uploadAt = "pre-activation";
    };
    "wireguard-lifeline-mail-2-mail-2-psk.secret" = {
      keyCommand = keyCommandEnv ++ [ "pass" "wireguard/lifeline-mail-2/psk" ];
      destDir = "/secrets";
      user = "root";
      group = "systemd-network";
      permissions = "0640";
      uploadAt = "pre-activation";
    };
  };
}