{ keyCommandEnv, ... }:
{
  deployment.keys = {
    "matrix-registration-shared-secret.secret" = {
      keyCommand = keyCommandEnv ++ [ "pass" "matrix/registration-shared-secret" ];
      destDir = "/secrets";
      user = "matrix-synapse";
      group = "matrix-synapse";
      permissions = "0640";
      uploadAt = "pre-activation";
    };
    "matrix-turn-shared-secret.secret" = {
      keyCommand = keyCommandEnv ++ [ "pass" "matrix/turn-shared-secret" ];
      destDir = "/secrets";
      user = "matrix-synapse";
      group = "matrix-synapse";
      permissions = "0640";
      uploadAt = "pre-activation";
    };
    "matrix-email-smtp-pass.secret" = {
      keyCommand = keyCommandEnv ++ [ "pass" "matrix/email-smtp-pass" ];
      destDir = "/secrets";
      user = "matrix-synapse";
      group = "matrix-synapse";
      permissions = "0640";
      uploadAt = "pre-activation";
    };
    "matrix-homeserver-signing-key.secret" = {
      keyCommand = keyCommandEnv ++ [ "pass" "matrix/homeserver-signing-key" ];
      destDir = "/secrets";
      user = "matrix-synapse";
      group = "matrix-synapse";
      permissions = "0640";
      uploadAt = "pre-activation";
    };
    "matrix-SYNCV3_SECRET.secret" = {
      keyCommand = keyCommandEnv ++ [ "pass" "matrix/SYNCV3_SECRET" ];
      destDir = "/secrets";
      user = "matrix-synapse";
      group = "matrix-synapse";
      permissions = "0640";
      uploadAt = "pre-activation";
    };
    "matrix-keycloak-client-secret.secret" = {
      keyCommand = keyCommandEnv ++ [ "pass" "matrix/keycloak-client-secret" ];
      destDir = "/secrets";
      user = "matrix-synapse";
      group = "matrix-synapse";
      permissions = "0640";
      uploadAt = "pre-activation";
    };
  };
}