let
  # Admin keys
  ldx = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKMNHFTC5HMO3IsggHpA+eVSCyhZSmDZz7aV62IFt7sj";
  ylw = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEtRkddBvOX+uSeWBbKzYPRSkTSGAwZox2WiQLV5yVUv";

  admins = [ ldx ylw ];

  # Host keys
  skydick = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDnuvNClEXwMEP0IVNZ8GM1V93eU+QMmBqM5R8TM1Sx2";
  xlab-gateway = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII+EKDpUPWahclzYF6o26AWfrRyZ3bW7D3l9oMo2J6Eg";

in {
  "skydick-wg.age".publicKeys = admins ++ [ skydick ];
  "xlab-wg-skyworks.age".publicKeys = admins ++ [ xlab-gateway ];
  "xlab-wg-wgnet.age".publicKeys = admins ++ [ xlab-gateway ];
  "xlab-wg-wgnet-psk.age".publicKeys = admins ++ [ xlab-gateway ];
  "xlab-wg-warp.age".publicKeys = admins ++ [ xlab-gateway ];
  "influxdb-token.age".publicKeys = admins ++ [ skydick ];
  "skydick-ldap-bind.age".publicKeys = admins ++ [ skydick ];
  "skydick-samba-ldap-admin.age".publicKeys = admins ++ [ skydick ];
}

# 重装系统一定要备份原机器的 ssh ed25519 私钥
# 否则他妈的比bitlocker还傻逼