refactor: complete rewrite

modules/nixos/base/secrets.nix

@@ -0,0 +1,31 @@
+{
+  config,
+  lib,
+  self,
+  ...
+}: let
+  inherit (lib) mkIf;
+
+  inherit (config.ooknet) host;
+  inherit (host) admin;
+  inherit (config.services) tailscale;
+in {
+  age.identityPaths = [
+    "/home/${admin.name}/.ssh/id_ed25519"
+  ];
+
+  age.secrets = {
+    tailscale-auth = mkIf tailscale.enable {
+      file = "${self}/secrets/tailscale-auth.age";
+      owner = "${admin.name}";
+      group = "users";
+      mode = "400";
+    };
+    github_key = mkIf admin.homeManager {
+      file = "${self}/secrets/github_key.age";
+      path = "/home/${admin.name}/.ssh/github_key";
+      owner = "${admin.name}";
+      group = "users";
+    };
+  };
+}