{ config, ... }:
{
  sops.templates = {
     "authentik-secrets.yaml" = {
      content = ''
        apiVersion: v1
        kind: Secret
        metadata:
          name: authentik-secrets
          namespace: default
        type: Opaque
        stringData:
          pg_pass: ${config.sops.placeholder."pg_pass"}
          authentik_secret_key: ${config.sops.placeholder."authentik_secret_key"}
      '';
      path = "/var/lib/rancher/k3s/server/manifests/authentik-secrets.yaml";
     }
  };
}