diff --git a/secrets/cloudflare-dns.age b/secrets/cloudflare-dns.age
new file mode 100644
index 0000000..f80c2e4
--- /dev/null
+++ b/secrets/cloudflare-dns.age
@@ -0,0 +1,45 @@
+age-encryption.org/v1
+-> ssh-ed25519 YUrFgQ my8JT1j/3JDO9YY06dH2kJQt7dD3TtQtJ21HHj/7Fmk
+gnY59AGgklfEeszPC1d65U8Lz661jbgey/N9FHWphWY
+-> ssh-rsa I7EAZw
+D0++p+22+PjdlS+2NDCTUAhxcNdpNwrc8/Logz0k9C0paS5Pml9slC2wgiSJDcFK
+XjBMmrjGm2OGhk5daEjyTOqBA3TIZ54oslSFuEL2C/p6Mikp1m2u9VXBH3zxnvwn
+ymKZzffBfrnC++g7zeXNRLShjZkxZ0tyVPdF3HmMdU5Ak2gJhyD5d3hJptqgIW37
+97nCq/jsgLFw/F33AYxVAST6AM5Mg86543225ane0D+oLz01Ruldxwt2aWQ9b04D
+soWYh/20VfGY3XEdhQH/EBCKx3gbpsxLle7WN6flZyE34KxS/+/Ib0DI5RN7+Wfx
+VoSsPJM5iq5Uc3WKGCkriITgVK0J/Kvfg2j4rj18fX5SkNQeQwuxJQ2qYcVSdXso
+sMxeZoxUwCZuC0GVOw91K+9OeONl3MEiYCbm+rcUFV+SOhSGdPmsO33mqRZ6W9GP
+iDZ+HscECBMNDslkr9+yAaROVkbo5pbmHGb7yCoUtVgQ6m6D/2ai5t7WbxMv/Rsz
+
+-> ssh-rsa 0pGLuA
+mE1zY7puFJxIzJP36XwyeKzFYFYzvDXjKZG6q/u7dftddZMCK+YhBZUvJNnV13YA
+Pqn+tuYgfWZoQOsTN2Jh63fu5Stl2MylrXNKYLGHm08r7kvBNm9u1Be8kTSba5/O
+5DxKCJGT/wTZnIfItbR7XgbAuR29l9yN9pTdi7kn35/SX4JlTenh5I0AvUZRcqSw
+llqZcx5VW/tCgk3k0lMCQjvH+E8Tcs+gUE1ciZJysDzPnYUCwFAKpmNf6ngck39U
+47gzgEWytMgjV8gtRzthx1oqE4Cl1wENjeZqzMq/jqKJlKZKcRrOLsDyl7Uf8zxM
+KDVP1ejYaa9uVFJVK0eX2H58gzIdqmBFhS15UQO+NfDJqQJKIohb0j2t9Heo/v5P
+WeRfsXQ8BaSMewaU6ZP9f+hangvE7kfOVqIx68XXrjB9Rk3xCuj4JPRElz00SgFA
+w+sblkf+U3nJoIsuUXLdANu2IFHZXG4Vg/9mSzMzNCX9u1WN6u3VnzusgoVxr/fT
+
+-> ssh-rsa JoBDow
+Pf4YMxK6SR1t5sEqEXw7j4FDshyuq+l//eO8WfZwDX9HTyEww1UyHqV24pnw+rEd
+F1XG/JTjgCLGQnus8NIJEGckcZMWAkOQTpsdO5L9z/9Tnt0YYpOxG88IbngWB2H7
+1tqDATx9Bi7y9SRYoqv1v9Tfs3cBuvOXfx/0RUUGcfh+uR0tz1f/8Yvu6b9yAPQJ
+Rvx3eSOJLrPdMzHcVi7gROQy2VJIdmMZA/6CWSkWTgYVoyzNnBr6ld2wzhtsU1cP
+kGGq3eg36SPlKXuxGw2zOKPc9WP5oQEZ5C9TJOpAnyM7V9v3bCEIvvCJ2es4+4SL
+AfibxWW5JD5Alhnm7G4+4Jlav1jhgtbrUAp3zITLO3xdZTU/FZllzP2n+SHs9pLj
+so7SZ3uajhuV2s0L/qcaX7C+iLPnW5zHN/Z/gRRGNAYG9oLRkjwnpr3ufd156L4p
+OxUr/0Yv4Gknv4hrMPswvyY4CThOzBGMhFdH35rqRv7xxG0i+XEJVyzqY0MP9itx
+
+-> ssh-rsa wzTCUg
+qWYSCXyyaXF9BmdnLCDq5g9tRMv1f/fLnQbhSiIo19n95ZPshyCjwXSFtl2x6bIQ
+oGw1TVfF/iEI6Izp+aIZZG5nOUcWKNh2NI5L/kU/9oTpsl0GqHnrAx2mRqp1hMec
+pc77PzedTeRjVUEc20rpD6jME9ZIbn2m7xLi7JW0fH+PcAmNMkWZme157cFZc35K
+nU6WdKxQegcntNzcOrGFnwpypk3dzLKejEC1ejsEcE9T+sqLbcvgtKHqM5MvCsMi
+rXkh5nt2REtVu0V1qmGm/VOzSkxkCKLTPTcjFdIqVC2oeWV5E1ahZcaCYxrweG/d
+LFyG0ealHCWOuQcwXayvXa1xVS0w2Kl5KoyExJJJsWM2tGZYJr9dSBsi7zJalAas
+hKMkyfbLlojsUc+KVOMR6+vZq5OYGNu/dArFMNstRplTs9hNMcDRR3MP+c5I5yMS
+xf+at4W7Eterjac+nI/tYi6vuYDnJcVOaoLiTxdsw96mdCdSbm9U0L0DhTMGR3yv
+
+--- Xg2rTiuVbENNHvWoZrg4hfjwBJSSye+iX9JheYYuNOs
+��u�ԫ9��4���0g��$���+B��ͯ����e��:	�9&�]|���_����su��TA�����\�
\ No newline at end of file
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
new file mode 100644
index 0000000..a7a3f9b
--- /dev/null
+++ b/secrets/secrets.nix
@@ -0,0 +1,17 @@
+let
+  pkgs = import <nixpkgs> {};
+  lib = pkgs.lib;
+
+  rpi4 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG0FSLInClzASv4Ul0bZ5Rxa59M7ExyCYt1emHOwztGr";
+
+  all-user = [
+    "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC6HOSwsMvNtv6iOxDLhSTnjREyAIGXoQ5IgC/mXfAIT9vA59fbI74wjdzbIUd9sZLd4mIExhdKw5ihaSOmsIb2x4tokjIHvjsdWJVBXqwqoYCd+9S4aoi5Nc0YHLCqTQM7LqJTCbE6HzLqkiZNhocgAnEIXpgcpnf0kB7suFXSKY/XY2ALFYXVohPfZTQsJqfkGkkVTgzglFV8kaVUeas0vLsDVU73lQjZ1oO4n2Ps+O9jbjFp3Zk/5txcKO3rVEqEy8vJLHIHFXnqo/2WOiM/ZagwoDXBwGZjH++klVwBb1Bu6MKbahI986gamVrWPgoRr/AaeC/WkVXIG3Yi4BG6sxhTlYoO3MwfnaQNetAAfT6XmzifTxtCGxIM5MdwC0n19C2qLwAU6EXhW0/W7RPqdsA5BcsQX9Fg+3yJX/xVwAeiRE5DzyI8aCkemXn7y7BAAbXG+e3YEetUrNjdRNWIeMrGv8LckE5z5sfifbwks5+++K+1X256bGX93m7Nn7U="
+    "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC4eg1TMjggwqdur1bsBqz4wzLchxAfcVl9XPJQ/Z4NCjKD+/lqmUQNt1n5ld5w/fRirkcsOIcoWSW1ioisvoZEtv5I5clQLLHA4sNIO2hXnNP3+XF+pB/eBZ6my4/nySl1QkDBEFE7HDTw0S6aZAkk3xoD08W2mU4xcVnVUeBUGyOy2Wt8NESYqwfw0qcIyRd37YmlOk22v/aVlMAsBSI73ug7/qTsVFp8G1py2BLi0ZwA5MfiZ8LZ6Y9gXFVGAA1pi2TiG+PVRMe9HsVHrxYX7crx6XnWmaa2o1KmxqWXriTd8zO2OGgoCW8klIeKnsJ3fGXJlLpcgxOXwg9vkE3EjWyihRrzooQdcfgrdxs7CY4D9OY2HrJ66h/bOtQgQCjI6/jN8SB+thhktj8fF5kSpB2hnquZPddVaRl83EmDqx03eqPVWtoGfEFi5/M6LGcqu8dYVoKioFnMFWaZVxlIn0goNCF6eV4+xPtFn/Wt6o4twYKJVEVXbhFQbiebUgk="
+    "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC0enlNbo1V5q0yq6n90gRPsNznoQ/KLEjeo1yOAUyJwPi35cw+b3p4DRN7T55DcSivKKE9Hyh6bpaQWFJSLyP5jAtDrYkuUfNx5GkgrquMwMvwzk3Z+h2/J/WgDyKQZXtm9LHYTgiW8jDU1lBiks39IqCAGrCTLAmAHSaJ39A4ZpJwu6zZ9sQqT22E/UpFm5MBezdZbm8V0G+beX+y3+pp8Kag7goGNY+rgTgx7REDz3jzZz3FBP+CxKoo1H8HHz78RDqBb8HKpVQYNQkwvIBeczKawRHIkJO2Mk+1mc6Ta6beA9+Uyf+puxco2xl6BOnDInvnhWJIRXOJuR5P8/YWprE1o4ixF2N95D2GlJ618V7faEovu/sNj8qIvfA66OF1gG+LOfNAl+u2+3V8ewATF493F0q04zhenoH1ZdrsACJfL8tK9Ev9056ImR6aSJ5BjqCk0tMmnLKTZ7q3R2LoKnB1r/TXe10OH7rx5BDAt4OmD8a5QS0RvVgK3O/iMW0="
+    "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDSAD3bCc9ZHGqU+HoCtp69uU3Px5bbVYYrHbLS3AS1Xku9rPKE/oUU/fz8/AZxp6dLuKhPjQjLzgbFjM0rK57fiOPqBnlw3eAiIymrlB03ALLV3y+GF2OhVf2rkcPkUxjK978dwS9bxgty6WzPAoSjNwilzgf2CcLcHyIzDwwzWCndM9jtpXbUbLhOH6CvsvygBD7j06wakLOorTS+cAFecUvaUkDr6gSu6zpM29DcFiq8T1VoWhBzwC/9IKnxV/XqaZBM3Em7NfPQIzYWcD9A5+Holj2I6jcTSd9xIdMhD4Miqm8IdojPkP2NuVfD9AMxn0ccwbROG/zliyXtcxRj8b3jEquBKuN+yGqF5hexmKlhHmHua9NwhsWnGWjOWWSaPtsp3WOM/fEc7cWpVWZ+W8V5LbdWEY3Ke52Cz35QbOSml09H/gIzsMxZbiZvkJB4PvWKf0FoyZ8ojJWIaGP1/LQdXNMWorqy7tWp3sAw3JcMsR0ezJ3YoI6Y6FOIdL0="
+  ];
+in
+{
+  "cloudflare-dns.age".publicKeys = [ rpi4 ] ++ all-user;
+}
+