{ config, lib, ... }:
with lib;
let
  cfg = config.nyxs-nix.services.k3s;
in
{
  sops.templates = mkIf cfg.enable {
     "authentik-secrets.yaml" = {
      content = ''
        apiVersion: v1
        kind: Secret
        metadata:
          name: authentik-secrets
          namespace: default
        type: Opaque
        stringData:
          pg_pass: ${config.sops.placeholder."pg_pass"}
          authentik_secret_key: ${config.sops.placeholder."authentik_secret_key"}
      '';
      path = "/var/lib/rancher/k3s/server/manifests/authentik-secrets.yaml";
     };
  };
}