77 files changed, 617 insertions, 729 deletions
diff --git a/flakes/private/openarc/flake.lock b/flakes/private/openarc/flake.lock
index 744d002..be75993 100644
--- a/flakes/private/openarc/flake.lock
+++ b/flakes/private/openarc/flake.lock
@@ -146,7 +146,7 @@
    },
    "secrets": {
      "locked": {
-        "narHash": "sha256-aRHKDVHDpnqpmgGhLGQxXwyTwmPuhUJTVcOLBYtY2ks=",
+        "narHash": "sha256-w3u1bMEJHCg9SqErJ5Qi0sTX2xx7mk+HrHZXzpjQd1w=",
        "path": "../../secrets",
        "type": "path"
      },
diff --git a/flakes/private/opendmarc/flake.lock b/flakes/private/opendmarc/flake.lock
index bd5019c..f40e1a9 100644
--- a/flakes/private/opendmarc/flake.lock
+++ b/flakes/private/opendmarc/flake.lock
@@ -129,7 +129,7 @@
    },
    "secrets": {
      "locked": {
-        "narHash": "sha256-aRHKDVHDpnqpmgGhLGQxXwyTwmPuhUJTVcOLBYtY2ks=",
+        "narHash": "sha256-w3u1bMEJHCg9SqErJ5Qi0sTX2xx7mk+HrHZXzpjQd1w=",
        "path": "../../secrets",
        "type": "path"
      },
diff --git a/flakes/private/opendmarc/flake.nix b/flakes/private/opendmarc/flake.nix
index 2b73070..e2575e7 100644
--- a/flakes/private/opendmarc/flake.nix
+++ b/flakes/private/opendmarc/flake.nix
@@ -53,9 +53,8 @@
              config.secrets.fullPaths."opendmarc/ignore.hosts"
            ];
          };
-          secrets.keys = [
+          secrets.keys = {
-            {
+            "opendmarc/ignore.hosts" = {
-              dest = "opendmarc/ignore.hosts";
              user = config.services.opendmarc.user;
              group = config.services.opendmarc.group;
              permissions = "0400";
@@ -67,8 +66,8 @@
                  builtins.concatStringsSep "\n" ([
                    config.myEnv.mail.dmarc.ignore_hosts
                  ] ++ lib.mapAttrsToList (n: v: v.fqdn) mxes);
-            }
+            };
-          ];
+          };
        };
      };
    in
diff --git a/flakes/secrets/flake.nix b/flakes/secrets/flake.nix
index 0ee6a40..ef74a30 100644
--- a/flakes/secrets/flake.nix
+++ b/flakes/secrets/flake.nix
@@ -5,9 +5,42 @@
    nixosModule = { config, lib, pkgs, ... }: {
      options.secrets = with lib; {
        keys = mkOption {
-          type = types.listOf types.unspecified;
+          type = types.attrsOf (types.submodule {
-          default = [];
+            options = {
-          description = "Keys to upload to server";
+              isTemplated = mkOption {
+                type = types.bool;
+                default = true;
+                description = "If the file is a gucci template that needs to be resolved";
+              };
+              isDir = mkOption {
+                type = types.bool;
+                default = false;
+                description = "If the entry is a directory";
+              };
+              group = mkOption {
+                type = types.str;
+                default = "root";
+                description = "Group to associate to the entry";
+              };
+              user = mkOption {
+                type = types.str;
+                default = "root";
+                description = "User to associate to the entry";
+              };
+              permissions = mkOption {
+                type = types.str;
+                default = "0600";
+                description = "Permissions to associate to the entry";
+              };
+              text = mkOption {
+                type = types.str;
+                description = "Content of the entry";
+              };
+            };
+          });
+          default = {};
+          description = "Keys attrs to upload to the server";
+          apply = lib.mapAttrsToList (dest: v: v // { inherit dest; });
        };
        gpgKeys = mkOption {
          type = types.listOf types.path;
@@ -52,20 +85,20 @@
        location = config.secrets.location;
        keys = config.secrets.keys;
        empty = pkgs.runCommand "empty" { preferLocalBuild = true; } "mkdir -p $out && touch $out/done";
-        fpath = v: "secrets/${v.dest}${lib.optionalString (v.isTemplated or true) ".gucci.tpl"}";
+        fpath = v: "secrets/${v.dest}${lib.optionalString v.isTemplated ".gucci.tpl"}";
        dumpKey = v:
-          if v.isDir or false then
+          if v.isDir then
            ''
              mkdir -p secrets/${v.dest}
              cat >> mods <<EOF
-              ${v.user or "root"} ${v.group or "root"} ${v.permissions or "0600"} secrets/${v.dest}
+              ${v.user} ${v.group} ${v.permissions} secrets/${v.dest}
              EOF
            ''
          else ''
            mkdir -p secrets/$(dirname ${v.dest})
            echo -n ${lib.strings.escapeShellArg v.text} > ${fpath v}
            cat >> mods <<EOF
-            ${v.user or "root"} ${v.group or "root"} ${v.permissions or "0600"} ${fpath v}
+            ${v.user} ${v.group} ${v.permissions} ${fpath v}
            EOF
            '';
        secrets = pkgs.runCommand "secrets.tar.enc" {
@@ -88,7 +121,7 @@
          '';
        pathChmodExcl =
          let
-            dirs = builtins.filter (v: v.isDir or false) keys;
+            dirs = builtins.filter (v: v.isDir) keys;
            exclPath = builtins.concatStringsSep " -o " (map (d: " -path $TMP/${d.dest}") dirs);
          in
            lib.optionalString (builtins.length dirs > 0) " -not \\( ${exclPath} \\) ";
diff --git a/modules/duply_backup/default.nix b/modules/duply_backup/default.nix
index 7034a91..846b1d4 100644
--- a/modules/duply_backup/default.nix
+++ b/modules/duply_backup/default.nix
@@ -75,24 +75,21 @@ in
    system.activationScripts.backup = ''
      install -m 0700 -o root -g root -d ${varDir} ${varDir}/caches
      '';
-    secrets.keys = lib.flatten (lib.mapAttrsToList (k: v:
+    secrets.keys = lib.listToAttrs (lib.flatten (lib.mapAttrsToList (k: v:
      map (remote: [
-        {
+        (lib.nameValuePair "backup/${varName k remote}/conf" {
          permissions = "0400";
-          dest = "backup/${varName k remote}/conf";
          text = duplyProfile v remote "${k}/";
-        }
+        })
-        {
+        (lib.nameValuePair "backup/${varName k remote}/exclude" {
          permissions = "0400";
-          dest = "backup/${varName k remote}/exclude";
          text = v.excludeFile;
-        }
+        })
-        {
+        (lib.nameValuePair "backup/${varName k remote}" {
          permissions = "0500";
-          dest = "backup/${varName k remote}";
          isDir = true;
-        }
+        })
-    ]) v.remotes) config.services.duplyBackup.profiles);
+    ]) v.remotes) config.services.duplyBackup.profiles));
    services.cron = {
      enable = true;
diff --git a/modules/naemon/default.nix b/modules/naemon/default.nix
index 976de69..60a75b3 100644
--- a/modules/naemon/default.nix
+++ b/modules/naemon/default.nix
@@ -124,9 +124,8 @@ in
  config = mkIf cfg.enable {
-    secrets.keys = [
+    secrets.keys = {
-      {
+      "naemon/resources.cfg" = {
-        dest = "naemon/resources.cfg";
        user = cfg.user;
        group = cfg.group;
        permissions = "0400";
@@ -134,8 +133,8 @@ in
          $USER1$=${pkgs.monitoring-plugins}/libexec
          ${cfg.extraResource}
          '';
-      }
+      };
-    ];
+    };
    users.users = optionalAttrs (cfg.user == "naemon") {
      naemon = {
diff --git a/modules/private/buildbot/default.nix b/modules/private/buildbot/default.nix
index 903f453..dc8a0d2 100644
--- a/modules/private/buildbot/default.nix
+++ b/modules/private/buildbot/default.nix
@@ -76,33 +76,30 @@ in
        '';
    }) config.myEnv.buildbot.projects;
-    secrets.keys = (
+    secrets.keys = lib.listToAttrs (
      lib.lists.flatten (
        lib.attrsets.mapAttrsToList (k: project:
          lib.attrsets.mapAttrsToList (k: v:
-            {
+            (lib.nameValuePair "buildbot/${project.name}/${k}" {
              permissions = "0600";
              user = "buildbot";
              group = "buildbot";
              text = v;
-              dest = "buildbot/${project.name}/${k}";
+            })
-            }
          ) project.secrets
          ++ [
-            {
+            (lib.nameValuePair "buildbot/${project.name}/webhook-httpd-include" {
              permissions = "0600";
              user = "wwwrun";
              group = "wwwrun";
              text = lib.optionalString (project.webhookTokens != null) ''
                Require expr "req('Access-Key') in { ${builtins.concatStringsSep ", " (map (x: "'${x}'") project.webhookTokens)} }"
                '';
-              dest = "buildbot/${project.name}/webhook-httpd-include";
+            })
-            }
+            (lib.nameValuePair "buildbot/${project.name}/environment_file" {
-            {
              permissions = "0600";
              user = "buildbot";
              group = "buildbot";
-              dest = "buildbot/${project.name}/environment_file";
              text = let
                project_env = with lib.attrsets;
                  mapAttrs' (k: v: nameValuePair "BUILDBOT_${k}" v) project.environment //
@@ -115,33 +112,30 @@ in
                  };
                in builtins.concatStringsSep "\n"
                  (lib.mapAttrsToList (envK: envV: "${envK}=${envV}") project_env);
-            }
+            })
          ]
        ) config.myEnv.buildbot.projects
      )
-    ) ++ [
+    ) // {
-      {
+      "buildbot/ldap" = {
        permissions = "0600";
        user = "buildbot";
        group = "buildbot";
        text = config.myEnv.buildbot.ldap.password;
-        dest = "buildbot/ldap";
+      };
-      }
+      "buildbot/worker_password" = {
-      {
        permissions = "0600";
        user = "buildbot";
        group = "buildbot";
        text = config.myEnv.buildbot.workerPassword;
-        dest = "buildbot/worker_password";
+      };
-      }
+      "buildbot/ssh_key" = {
-      {
        permissions = "0600";
        user = "buildbot";
        group = "buildbot";
        text = config.myEnv.buildbot.ssh_key.private;
-        dest = "buildbot/ssh_key";
+      };
-      }
+    };
-    ];
    services.filesWatcher = lib.attrsets.mapAttrs' (k: project: lib.attrsets.nameValuePair "buildbot-${project.name}" {
      restart = true;
diff --git a/modules/private/databases/mariadb.nix b/modules/private/databases/mariadb.nix
index 75ea747..101eb3f 100644
--- a/modules/private/databases/mariadb.nix
+++ b/modules/private/databases/mariadb.nix
@@ -121,9 +121,8 @@ in {
      '';
    };
-    secrets.keys = [
+    secrets.keys = {
-      {
+      "mysql/mysqldump" = {
-        dest = "mysql/mysqldump";
        permissions = "0400";
        user = "root";
        group = "root";
@@ -132,9 +131,8 @@ in {
          user = root
          password = ${cfg.credentials.root}
        '';
-      }
+      };
-      {
+      "mysql/pam" = {
-        dest = "mysql/pam";
        permissions = "0400";
        user = "mysql";
        group = "mysql";
@@ -146,9 +144,8 @@ in {
          pam_filter ${filter}
          ssl start_tls
        '';
-      }
+      };
-      {
+      "mysql/pam_replication" = {
-        dest = "mysql/pam_replication";
        permissions = "0400";
        user = "mysql";
        group = "mysql";
@@ -160,8 +157,8 @@ in {
          pam_login_attribute cn
          ssl start_tls
        '';
-      }
+      };
-    ];
+    };
    security.pam.services = let
      pam_ldap = "${pkgs.pam_ldap}/lib/security/pam_ldap.so";
diff --git a/modules/private/databases/mariadb_replication.nix b/modules/private/databases/mariadb_replication.nix
index e857c41..68e6f7f 100644
--- a/modules/private/databases/mariadb_replication.nix
+++ b/modules/private/databases/mariadb_replication.nix
@@ -81,9 +81,8 @@ in
    };
    users.groups.mysql.gid = config.ids.gids.mysql;
-    secrets.keys = lib.flatten (lib.mapAttrsToList (name: hcfg: [
+    secrets.keys = lib.listToAttrs (lib.flatten (lib.mapAttrsToList (name: hcfg: [
-      {
+      (lib.nameValuePair "mysql_replication/${name}/slave_init_commands" {
-        dest = "mysql_replication/${name}/slave_init_commands";
        user = "mysql";
        group = "mysql";
        permissions = "0400";
@@ -91,9 +90,8 @@ in
          CHANGE MASTER TO master_host="${hcfg.host}", master_port=${hcfg.port}, master_user="${hcfg.user}", master_password="${hcfg.password}", master_ssl=1, master_use_gtid=slave_pos;
          START SLAVE;
          '';
-      }
+      })
-      {
+      (lib.nameValuePair "mysql_replication/${name}/mysqldump_remote" {
-        dest = "mysql_replication/${name}/mysqldump_remote";
        permissions = "0400";
        user = "root";
        group = "root";
@@ -102,9 +100,8 @@ in
          user = ${hcfg.user}
          password = ${hcfg.password}
        '';
-      }
+      })
-      {
+      (lib.nameValuePair "mysql_replication/${name}/mysqldump" {
-        dest = "mysql_replication/${name}/mysqldump";
        permissions = "0400";
        user = "root";
        group = "root";
@@ -113,9 +110,8 @@ in
          user = ${hcfg.dumpUser}
          password = ${hcfg.dumpPassword}
        '';
-      }
+      })
-      {
+      (lib.nameValuePair "mysql_replication/${name}/client" {
-        dest = "mysql_replication/${name}/client";
        permissions = "0400";
        user = "mysql";
        group = "mysql";
@@ -124,8 +120,8 @@ in
          user = ${hcfg.dumpUser}
          password = ${hcfg.dumpPassword}
        '';
-      }
+      })
-    ]) cfg.hosts);
+    ]) cfg.hosts));
    services.cron = {
      enable = true;
diff --git a/modules/private/databases/openldap/default.nix b/modules/private/databases/openldap/default.nix
index f4851b5..d35aca0 100644
--- a/modules/private/databases/openldap/default.nix
+++ b/modules/private/databases/openldap/default.nix
@@ -85,29 +85,26 @@ in
  };
  config = lib.mkIf cfg.enable {
-    secrets.keys = [
+    secrets.keys = {
-       {
+       "ldap/password" = {
-        dest = "ldap/password";
        permissions = "0400";
        user = "openldap";
        group = "openldap";
        text = "rootpw          ${cfg.rootPw}";
-      }
+      };
-      {
+      "ldap/access" = {
-        dest = "ldap/access";
        permissions = "0400";
        user = "openldap";
        group = "openldap";
        text = builtins.readFile cfg.accessFile;
-      }
+      };
-      {
+      "ldap" = {
-        dest = "ldap";
        permissions = "0500";
        user = "openldap";
        group = "openldap";
        isDir = true;
-      }
+      };
-    ];
+    };
    users.users.openldap.extraGroups = [ "keys" ];
    networking.firewall.allowedTCPPorts = [ 636 389 ];
diff --git a/modules/private/databases/openldap_replication.nix b/modules/private/databases/openldap_replication.nix
index 350eecf..b456323 100644
--- a/modules/private/databases/openldap_replication.nix
+++ b/modules/private/databases/openldap_replication.nix
@@ -87,9 +87,8 @@ in
    };
    users.groups.openldap.gid = config.ids.gids.openldap;
-    secrets.keys = lib.flatten (lib.mapAttrsToList (name: hcfg: [
+    secrets.keys = lib.listToAttrs (lib.flatten (lib.mapAttrsToList (name: hcfg: [
-      {
+      (lib.nameValuePair "openldap_replication/${name}/replication_config" {
-        dest = "openldap_replication/${name}/replication_config";
        user = "openldap";
        group = "openldap";
        permissions = "0400";
@@ -105,15 +104,14 @@ in
                  binddn="${hcfg.dn}"
                  credentials="${hcfg.password}"
          '';
-      }
+      })
-      {
+      (lib.nameValuePair "openldap_replication/${name}/replication_password" {
-        dest = "openldap_replication/${name}/replication_password";
        user = "openldap";
        group = "openldap";
        permissions = "0400";
        text = hcfg.password;
-      }
+      })
-    ]) cfg.hosts);
+    ]) cfg.hosts));
    services.cron = {
      enable = true;
diff --git a/modules/private/databases/postgresql.nix b/modules/private/databases/postgresql.nix
index e73bf69..a6c4cc9 100644
--- a/modules/private/databases/postgresql.nix
+++ b/modules/private/databases/postgresql.nix
@@ -178,9 +178,8 @@ in {
      '';
    };
-    secrets.keys = [
+    secrets.keys = {
-      {
+      "postgresql/pam" = {
-        dest = "postgresql/pam";
        permissions = "0400";
        group = "postgres";
        user = "postgres";
@@ -192,9 +191,8 @@ in {
          pam_filter ${filter}
          ssl start_tls
        '';
-      }
+      };
-      {
+      "postgresql/pam_replication" = {
-        dest = "postgresql/pam_replication";
        permissions = "0400";
        group = "postgres";
        user = "postgres";
@@ -206,8 +204,8 @@ in {
          pam_login_attribute cn
          ssl start_tls
        '';
-      }
+      };
-    ];
+    };
    security.pam.services = let
      pam_ldap = "${pkgs.pam_ldap}/lib/security/pam_ldap.so";
diff --git a/modules/private/databases/postgresql_replication.nix b/modules/private/databases/postgresql_replication.nix
index b103b8c..135bbed 100644
--- a/modules/private/databases/postgresql_replication.nix
+++ b/modules/private/databases/postgresql_replication.nix
@@ -62,9 +62,8 @@ in
    users.groups.postgres.gid = config.ids.gids.postgres;
    environment.systemPackages = [ cfg.mainPackage ];
-    secrets.keys = lib.flatten (lib.mapAttrsToList (name: hcfg: [
+    secrets.keys = lib.listToAttrs (lib.flatten (lib.mapAttrsToList (name: hcfg: [
-      {
+      (lib.nameValuePair "postgresql_replication/${name}/recovery.conf" {
-        dest = "postgresql_replication/${name}/recovery.conf";
        user = "postgres";
        group = "postgres";
        permissions = "0400";
@@ -73,16 +72,14 @@ in
          primary_conninfo = '${hcfg.connection}?sslmode=require'
          primary_slot_name = '${hcfg.slot}'
          '';
-      }
+      })
-      {
+      (lib.nameValuePair "postgresql_replication/${name}/connection_string" {
-        dest = "postgresql_replication/${name}/connection_string";
        user = "postgres";
        group = "postgres";
        permissions = "0400";
        text = hcfg.connection;
-      }
+      })
-      {
+      (lib.nameValuePair "postgresql_replication/${name}/postgresql.conf" {
-        dest = "postgresql_replication/${name}/postgresql.conf";
        user = "postgres";
        group = "postgres";
        permissions = "0400";
@@ -94,8 +91,8 @@ in
          data_directory = '${dataDir}'
          wal_level = logical
          '';
-      }
+      })
-    ]) cfg.hosts);
+    ]) cfg.hosts));
    services.cron = {
      enable = true;
diff --git a/modules/private/databases/redis.nix b/modules/private/databases/redis.nix
index 5c5b8b0..685fa46 100644
--- a/modules/private/databases/redis.nix
+++ b/modules/private/databases/redis.nix
@@ -74,9 +74,8 @@ in {
    };
    networking.firewall.allowedTCPPorts = [ 7617 16379 ];
-    secrets.keys = [
+    secrets.keys = {
-      {
+      "redis/predixy.conf" = {
-        dest = "redis/predixy.conf";
        user = "redis";
        group = "redis";
        permissions = "0400";
@@ -100,15 +99,14 @@ in {
            }
          }
          '';
-      }
+      };
-      {
+      "redis/spiped_keyfile" = {
-        dest = "redis/spiped_keyfile";
        user = "spiped";
        group = "spiped";
        permissions = "0400";
        text = config.myEnv.databases.redis.spiped_key;
-      }
+      };
-    ];
+    };
    systemd.slices.redis = {
      description = "Redis slice";
diff --git a/modules/private/databases/redis_replication.nix b/modules/private/databases/redis_replication.nix
index 3caa7e9..9e48939 100644
--- a/modules/private/databases/redis_replication.nix
+++ b/modules/private/databases/redis_replication.nix
@@ -68,9 +68,8 @@ in
      };
    };
-    secrets.keys = lib.flatten (lib.mapAttrsToList (name: hcfg: [
+    secrets.keys = lib.mapAttrs' (name: hcfg:
-      {
+      lib.nameValuePair "redis_replication/${name}/config" {
-        dest = "redis_replication/${name}/config";
        user = "redis";
        group = "redis";
        permissions = "0400";
@@ -97,15 +96,14 @@ in
          maxclients 1024
          '';
      }
-    ]) cfg.hosts) ++ [
+    ) cfg.hosts // {
-      { # For eldiron only
+      "redis/spiped_eldiron_keyfile" = { # For eldiron only
-        dest = "redis/spiped_eldiron_keyfile";
        user = "spiped";
        group = "spiped";
        permissions = "0400";
        text = config.myEnv.databases.redis.spiped_key;
-      }
+      };
-    ];
+    };
    services.cron = {
      enable = true;
diff --git a/modules/private/dns.nix b/modules/private/dns.nix
index 32c52a9..1d7fd52 100644
--- a/modules/private/dns.nix
+++ b/modules/private/dns.nix
@@ -87,9 +87,8 @@
    networking.firewall.allowedUDPPorts = [ 53 ];
    networking.firewall.allowedTCPPorts = [ 53 ];
    users.users.named.extraGroups = [ "keys" ];
-    secrets.keys = lib.mapAttrsToList (k: v:
+    secrets.keys = lib.mapAttrs' (k: v:
-      {
+      lib.nameValuePair "bind/${k}.key" {
-        dest = "bind/${k}.key";
        permissions = "0400";
        user = "named";
        text = ''
diff --git a/modules/private/ejabberd/default.nix b/modules/private/ejabberd/default.nix
index d051d79..4d86a64 100644
--- a/modules/private/ejabberd/default.nix
+++ b/modules/private/ejabberd/default.nix
@@ -37,9 +37,8 @@ in
    systemd.services.ejabberd.postStop = ''
      rm /var/log/ejabberd/erl_crash*.dump
      '';
-    secrets.keys = [
+    secrets.keys = {
-      {
+      "ejabberd/psql.yml" = {
-        dest = "ejabberd/psql.yml";
        permissions = "0400";
        user = "ejabberd";
        group = "ejabberd";
@@ -50,9 +49,8 @@ in
          sql_username: "${config.myEnv.jabber.postgresql.user}"
          sql_password: "${config.myEnv.jabber.postgresql.password}"
          '';
-      }
+      };
-      {
+      "ejabberd/host.yml" = {
-        dest = "ejabberd/host.yml";
        permissions = "0400";
        user = "ejabberd";
        group = "ejabberd";
@@ -71,8 +69,8 @@ in
                immaeXmppUid: "%u"
              ldap_filter: "${config.myEnv.jabber.ldap.filter}"
          '';
-      }
+      };
-    ];
+    };
    users.users.ejabberd.extraGroups = [ "keys" ];
    services.ejabberd = {
      package = pkgs.ejabberd.override { withPgsql = true; };
diff --git a/modules/private/ftp.nix b/modules/private/ftp.nix
index 07db0f4..1428198 100644
--- a/modules/private/ftp.nix
+++ b/modules/private/ftp.nix
@@ -47,8 +47,7 @@ in
      install -m 0755 -o ftp -g ftp -d /var/lib/ftp
      '';
-    secrets.keys = [{
+    secrets.keys."pure-ftpd-ldap" = {
-      dest = "pure-ftpd-ldap";
      permissions = "0400";
      user = "ftp";
      group = "ftp";
@@ -71,7 +70,7 @@ in
        # Compile dans pure-ftpd directement avec immaeFtpUid / immaeFtpGid
        LDAPHomeDir         immaeFtpDirectory
        '';
-    }];
+    };
    services.filesWatcher.pure-ftpd = {
      restart = true;
diff --git a/modules/private/gitolite/default.nix b/modules/private/gitolite/default.nix
index 0fb1a99..20d2cd5 100644
--- a/modules/private/gitolite/default.nix
+++ b/modules/private/gitolite/default.nix
@@ -21,13 +21,12 @@ in {
    };
    networking.firewall.allowedTCPPorts = [ 9418 ];
-    secrets.keys = [{
+    secrets.keys."gitolite/ldap_password" = {
-      dest = "gitolite/ldap_password";
      user = "gitolite";
      group = "gitolite";
      permissions = "0400";
      text = config.myEnv.tools.gitolite.ldap.password;
-    }];
+    };
    services.gitDaemon = {
      enable = true;
diff --git a/modules/private/mail/dovecot.nix b/modules/private/mail/dovecot.nix
index 23e795f..0ef3467 100644
--- a/modules/private/mail/dovecot.nix
+++ b/modules/private/mail/dovecot.nix
@@ -18,36 +18,33 @@ in
      + /var/lib/dhparams
      + /var/lib/dovecot
      '';
-    secrets.keys = [
+    secrets.keys."dovecot/ldap" = {
-      {
+      user = config.services.dovecot2.user;
-        dest = "dovecot/ldap";
+      group = config.services.dovecot2.group;
-        user = config.services.dovecot2.user;
+      permissions = "0400";
-        group = config.services.dovecot2.group;
+      text = ''
-        permissions = "0400";
+        hosts = ${config.myEnv.mail.dovecot.ldap.host}
-        text = ''
+        tls = yes
-          hosts = ${config.myEnv.mail.dovecot.ldap.host}
-          tls = yes
-          dn = ${config.myEnv.mail.dovecot.ldap.dn}
+        dn = ${config.myEnv.mail.dovecot.ldap.dn}
-          dnpass = ${config.myEnv.mail.dovecot.ldap.password}
+        dnpass = ${config.myEnv.mail.dovecot.ldap.password}
-          auth_bind = yes
+        auth_bind = yes
-          ldap_version = 3
+        ldap_version = 3
-          base = ${config.myEnv.mail.dovecot.ldap.base}
+        base = ${config.myEnv.mail.dovecot.ldap.base}
-          scope = subtree
+        scope = subtree
-          pass_filter = ${config.myEnv.mail.dovecot.ldap.filter}
+        pass_filter = ${config.myEnv.mail.dovecot.ldap.filter}
-          pass_attrs = ${config.myEnv.mail.dovecot.ldap.pass_attrs}
+        pass_attrs = ${config.myEnv.mail.dovecot.ldap.pass_attrs}
-          user_attrs = ${config.myEnv.mail.dovecot.ldap.user_attrs}
+        user_attrs = ${config.myEnv.mail.dovecot.ldap.user_attrs}
-          user_filter = ${config.myEnv.mail.dovecot.ldap.filter}
+        user_filter = ${config.myEnv.mail.dovecot.ldap.filter}
-          iterate_attrs = ${config.myEnv.mail.dovecot.ldap.iterate_attrs}
+        iterate_attrs = ${config.myEnv.mail.dovecot.ldap.iterate_attrs}
-          iterate_filter = ${config.myEnv.mail.dovecot.ldap.iterate_filter}
+        iterate_filter = ${config.myEnv.mail.dovecot.ldap.iterate_filter}
-          '';
+        '';
-      }
+    };
-    ];
    users.users.vhost = {
      group = "vhost";
diff --git a/modules/private/mail/milters.nix b/modules/private/mail/milters.nix
index 172e216..4b93a7a 100644
--- a/modules/private/mail/milters.nix
+++ b/modules/private/mail/milters.nix
@@ -17,30 +17,27 @@
      '';
  };
  config = lib.mkIf (config.myServices.mail.enable || config.myServices.mailBackup.enable) {
-    secrets.keys = [
+    secrets.keys = {
-      {
+      "opendkim" = {
-        dest = "opendkim";
        isDir = true;
        user = config.services.opendkim.user;
        group = config.services.opendkim.group;
        permissions = "0550";
-      }
+      };
-      {
+      "opendkim/eldiron.private" = {
-        dest = "opendkim/eldiron.private";
        user = config.services.opendkim.user;
        group = config.services.opendkim.group;
        permissions = "0400";
        text = config.myEnv.mail.dkim.eldiron.private;
-      }
+      };
-      {
+      "opendkim/eldiron.txt" = {
-        dest = "opendkim/eldiron.txt";
        user = config.services.opendkim.user;
        group = config.services.opendkim.group;
        permissions = "0444";
        text = ''
          eldiron._domainkey    IN      TXT     ${config.myEnv.mail.dkim.eldiron.public}'';
-      }
+      };
-    ];
+    };
    users.users."${config.services.opendkim.user}".extraGroups = [ "keys" ];
    services.opendkim = {
      enable = true;
diff --git a/modules/private/mail/opensmtpd.nix b/modules/private/mail/opensmtpd.nix
index a7be066..e05bba9 100644
--- a/modules/private/mail/opensmtpd.nix
+++ b/modules/private/mail/opensmtpd.nix
@@ -1,17 +1,14 @@
 { lib, pkgs, config, name, ... }:
 {
  config = lib.mkIf config.myServices.mailRelay.enable {
-    secrets.keys = [
+    secrets.keys."opensmtpd/creds" = {
-      {
+      user = "smtpd";
-        dest = "opensmtpd/creds";
+      group = "smtpd";
-        user = "smtpd";
+      permissions = "0400";
-        group = "smtpd";
+      text = ''
-        permissions = "0400";
+        eldiron    ${name}:${config.hostEnv.ldap.password}
-        text = ''
+        '';
-          eldiron    ${name}:${config.hostEnv.ldap.password}
+    };
-          '';
-      }
-    ];
    users.users.smtpd.extraGroups = [ "keys" ];
    services.opensmtpd = {
      enable = true;
diff --git a/modules/private/mail/postfix.nix b/modules/private/mail/postfix.nix
index de5e59d..054b93e 100644
--- a/modules/private/mail/postfix.nix
+++ b/modules/private/mail/postfix.nix
@@ -4,9 +4,8 @@
    services.duplyBackup.profiles.mail.excludeFile = ''
      + /var/lib/postfix
      '';
-    secrets.keys = [
+    secrets.keys = {
-      {
+      "postfix/mysql_alias_maps" = {
-        dest = "postfix/mysql_alias_maps";
        user = config.services.postfix.user;
        group = config.services.postfix.group;
        permissions = "0440";
@@ -32,9 +31,8 @@
              FROM forwardings_blacklisted
              WHERE source = '%s'
          '';
-      }
+      };
-      {
+      "postfix/ldap_mailboxes" = {
-        dest = "postfix/ldap_mailboxes";
        user = config.services.postfix.user;
        group = config.services.postfix.group;
        permissions = "0440";
@@ -48,9 +46,8 @@
          result_format = dummy
          version = 3
        '';
-      }
+      };
-      {
+      "postfix/mysql_sender_login_maps" = {
-        dest = "postfix/mysql_sender_login_maps";
        user = config.services.postfix.user;
        group = config.services.postfix.group;
        permissions = "0440";
@@ -72,9 +69,8 @@
              AND active = 1
            UNION SELECT CONCAT(SUBSTRING_INDEX('%u', '+', 1), '@%d') AS destination
          '';
-      }
+      };
-      {
+      "postfix/mysql_sender_relays_maps" = {
-        dest = "postfix/mysql_sender_relays_maps";
        user = config.services.postfix.user;
        group = config.services.postfix.group;
        permissions = "0440";
@@ -102,9 +98,8 @@
              ((regex = 1 AND '%s' REGEXP CONCAT('^',`from`,'$') ) OR (regex = 0 AND `from` = '%s'))
              AND active = 1
          '';
-      }
+      };
-      {
+      "postfix/mysql_sender_relays_hosts" = {
-        dest = "postfix/mysql_sender_relays_hosts";
        user = config.services.postfix.user;
        group = config.services.postfix.group;
        permissions = "0440";
@@ -122,9 +117,8 @@
              ((regex = 1 AND '%s' REGEXP CONCAT('^',`from`,'$') ) OR (regex = 0 AND `from` = '%s'))
              AND active = 1
          '';
-      }
+      };
-      {
+      "postfix/mysql_sender_relays_creds" = {
-        dest = "postfix/mysql_sender_relays_creds";
        user = config.services.postfix.user;
        group = config.services.postfix.group;
        permissions = "0440";
@@ -142,9 +136,8 @@
              ((regex = 1 AND '%s' REGEXP CONCAT('^',`from`,'$') ) OR (regex = 0 AND `from` = '%s'))
              AND active = 1
          '';
-      }
+      };
-      {
+      "postfix/ldap_ejabberd_users_immae_fr" = {
-        dest = "postfix/ldap_ejabberd_users_immae_fr";
        user = config.services.postfix.user;
        group = config.services.postfix.group;
        permissions = "0440";
@@ -159,14 +152,13 @@
          result_format = ejabberd@localhost
          version = 3
          '';
-      }
+      };
-    ] ++ (lib.mapAttrsToList (name: v: {
+    } // lib.mapAttrs' (name: v: lib.nameValuePair "postfix/scripts/${name}-env" {
-      dest = "postfix/scripts/${name}-env";
      user = "postfixscripts";
      group = "root";
      permissions = "0400";
      text = builtins.toJSON v.env;
-    }) config.myEnv.mail.scripts);
+    }) config.myEnv.mail.scripts;
    networking.firewall.allowedTCPPorts = [ 25 465 587 ];
diff --git a/modules/private/mail/relay.nix b/modules/private/mail/relay.nix
index 651452c..668d365 100644
--- a/modules/private/mail/relay.nix
+++ b/modules/private/mail/relay.nix
@@ -13,9 +13,8 @@
        mxs = map (zone: "${config.myEnv.servers."${name}".mx.subdomain}.${zone.name}") zonesWithMx;
      in builtins.listToAttrs (map (mx: lib.attrsets.nameValuePair mx null) mxs);
    };
-    secrets.keys = [
+    secrets.keys = {
-      {
+      "postfix/mysql_alias_maps" = {
-        dest = "postfix/mysql_alias_maps";
        user = config.services.postfix.user;
        group = config.services.postfix.group;
        permissions = "0440";
@@ -41,9 +40,8 @@
              FROM forwardings_blacklisted
              WHERE source = '%s'
          '';
-      }
+      };
-      {
+      "postfix/ldap_mailboxes" = {
-        dest = "postfix/ldap_mailboxes";
        user = config.services.postfix.user;
        group = config.services.postfix.group;
        permissions = "0440";
@@ -57,9 +55,8 @@
          result_format = dummy
          version = 3
        '';
-      }
+      };
-      {
+      "postfix/sympa_mailbox_maps" = {
-        dest = "postfix/sympa_mailbox_maps";
        user = config.services.postfix.user;
        group = config.services.postfix.group;
        permissions = "0440";
@@ -82,9 +79,8 @@
              CONCAT('abuse-feedback-report@', robot_list)
            )
        '';
-      }
+      };
-      {
+      "postfix/ldap_ejabberd_users_immae_fr" = {
-        dest = "postfix/ldap_ejabberd_users_immae_fr";
        user = config.services.postfix.user;
        group = config.services.postfix.group;
        permissions = "0440";
@@ -99,8 +95,8 @@
          result_format = ejabberd@localhost
          version = 3
          '';
-      }
+      };
-    ];
+    };
    networking.firewall.allowedTCPPorts = [ 25 ];
diff --git a/modules/private/mail/sympa.nix b/modules/private/mail/sympa.nix
index 5270b69..920daa9 100644
--- a/modules/private/mail/sympa.nix
+++ b/modules/private/mail/sympa.nix
@@ -34,20 +34,19 @@ in
      ];
    };
-    secrets.keys = [
+    secrets.keys = {
-      {
+      "sympa/db_password" = {
-        dest = "sympa/db_password";
        permissions = "0400";
        group = "sympa";
        user = "sympa";
        text = sympaConfig.postgresql.password;
-      }
+      };
-    ]
+    }
-    ++ lib.mapAttrsToList (n: v: {
+    // lib.mapAttrs' (n: v: lib.nameValuePair "sympa/data_sources/${n}.incl" {
-      dest = "sympa/data_sources/${n}.incl"; permissions = "0400"; group = "sympa"; user = "sympa"; text = v;
+      permissions = "0400"; group = "sympa"; user = "sympa"; text = v;
    }) sympaConfig.data_sources
-    ++ lib.mapAttrsToList (n: v: {
+    // lib.mapAttrs' (n: v: lib.nameValuePair "sympa/scenari/${n}" {
-      dest = "sympa/scenari/${n}"; permissions = "0400"; group = "sympa"; user = "sympa"; text = v;
+      permissions = "0400"; group = "sympa"; user = "sympa"; text = v;
    }) sympaConfig.scenari;
    users.users.sympa.extraGroups = [ "keys" ];
    systemd.slices.mail-sympa = {
diff --git a/modules/private/monitoring/default.nix b/modules/private/monitoring/default.nix
index cab9e7c..bdb5c93 100644
--- a/modules/private/monitoring/default.nix
+++ b/modules/private/monitoring/default.nix
@@ -199,18 +199,15 @@ in
      text = "MAILADDR ${config.myEnv.monitoring.email}";
    };
-    secrets.keys = [
+    secrets.keys = {
-      {
+      "naemon/id_rsa" = {
-        dest = "naemon/id_rsa";
        user = "naemon";
        group = "naemon";
        permissions = "0400";
        text = config.myEnv.monitoring.ssh_secret_key;
-      }
+      };
-    ] ++ lib.optionals cfg.master (
+    } // lib.optionalAttrs cfg.master (
-      lib.mapAttrsToList (k: v:
+      lib.mapAttrs' (k: v: lib.nameValuePair "${k}_access_key" {
-      {
-        dest = "${k}_access_key";
        user = "naemon";
        group = "naemon";
        permissions = "0400";
diff --git a/modules/private/monitoring/status.nix b/modules/private/monitoring/status.nix
index 73f4749..ab0290c 100644
--- a/modules/private/monitoring/status.nix
+++ b/modules/private/monitoring/status.nix
@@ -12,17 +12,14 @@
    };
  };
  config = lib.mkIf config.myServices.status.enable {
-    secrets.keys = [
+    secrets.keys."naemon-status/environment" = {
-      {
+      user = "naemon";
-        dest = "naemon-status/environment";
+      group = "naemon";
-        user = "naemon";
+      permissions = "0400";
-        group = "naemon";
+      text = ''
-        permission = "0400";
+        TOKENS=${builtins.concatStringsSep " " config.myEnv.monitoring.nrdp_tokens}
-        text = ''
+        '';
-          TOKENS=${builtins.concatStringsSep " " config.myEnv.monitoring.nrdp_tokens}
+    };
-          '';
-      }
-    ];
    services.nginx = {
      enable = true;
      recommendedOptimisation = true;
diff --git a/modules/private/monitoring/status_engine.nix b/modules/private/monitoring/status_engine.nix
index 8192a9d..39a753a 100644
--- a/modules/private/monitoring/status_engine.nix
+++ b/modules/private/monitoring/status_engine.nix
@@ -19,8 +19,7 @@ in
      };
    };
-    secrets.keys = [{
+    secrets.keys."status_engine" = {
-      dest = "status_engine";
      permissions = "0400";
      user = "naemon";
      group = "naemon";
@@ -87,7 +86,7 @@ in
        disable_http_proxy: 1
      '';
-    }];
+    };
    services.redis = rec {
      enable = true;
diff --git a/modules/private/mpd.nix b/modules/private/mpd.nix
index f2e87bb..7fa8fe9 100644
--- a/modules/private/mpd.nix
+++ b/modules/private/mpd.nix
@@ -5,22 +5,20 @@
    services.duplyBackup.profiles.mpd = {
      rootDir = "/var/lib/mpd";
    };
-    secrets.keys = [
+    secrets.keys = {
-      {
+      "mpd" = {
-        dest = "mpd";
        permissions = "0400";
        text = config.myEnv.mpd.password;
-      }
+      };
-      {
+      "mpd-config" = {
-        dest = "mpd-config";
        permissions = "0400";
        user = "mpd";
        group = "mpd";
        text = ''
          password "${config.myEnv.mpd.password}@read,add,control,admin"
        '';
-      }
+      };
-    ];
+    };
    networking.firewall.allowedTCPPorts = [ 6600 ];
    users.users.mpd.extraGroups = [ "wwwrun" "keys" ];
    systemd.services.mpd.serviceConfig.RuntimeDirectory = "mpd";
diff --git a/modules/private/ssh/default.nix b/modules/private/ssh/default.nix
index ca9b6fc..ee5dda5 100644
--- a/modules/private/ssh/default.nix
+++ b/modules/private/ssh/default.nix
@@ -51,13 +51,12 @@ in
      AuthorizedKeysCommandUser nobody
      '';
-    secrets.keys = [{
+    secrets.keys."ssh-ldap" = {
-      dest = "ssh-ldap";
      user = "nobody";
      group = "nogroup";
      permissions = "0400";
      text = config.myEnv.sshd.ldap.password;
-    }];
+    };
    system.activationScripts.sshd = {
      deps = [ "secrets" ];
      text = ''
diff --git a/modules/private/system/backup-2.nix b/modules/private/system/backup-2.nix
index 181f455..c01a666 100644
--- a/modules/private/system/backup-2.nix
+++ b/modules/private/system/backup-2.nix
@@ -7,22 +7,20 @@
  };
  # ssh-keyscan backup-2 | nix-shell -p ssh-to-age --run ssh-to-age
  secrets.ageKeys = [ "age1kk3nr27qu42j28mcfdag5lhq0zu2pky7gfanvne8l4z2ctevjpgskmw0sr" ];
-  secrets.keys = [
+  secrets.keys = {
-    {
+    "rsync_backup/identity" = {
-      dest = "rsync_backup/identity";
      user = "backup";
      group = "backup";
      permissions = "0400";
      text = config.myEnv.rsync_backup.ssh_key.private;
-    }
+    };
-    {
+    "rsync_backup/identity.pub" = {
-      dest = "rsync_backup/identity.pub";
      user = "backup";
      group = "backup";
      permissions = "0444";
      text = config.myEnv.rsync_backup.ssh_key.public;
-    }
+    };
-  ];
+  };
  boot.kernelPackages = pkgs.linuxPackages_latest;
  myEnv = import ../../../nixops/secrets/environment.nix;
diff --git a/modules/private/system/eldiron.nix b/modules/private/system/eldiron.nix
index 0830f18..2c339a5 100644
--- a/modules/private/system/eldiron.nix
+++ b/modules/private/system/eldiron.nix
@@ -126,9 +126,8 @@
  services.netdata.config.web.mode = "none";
  users.users."${config.services.netdata.user}".extraGroups = [ "keys" ];
  environment.etc."netdata/stream.conf".source = config.secrets.fullPaths."netdata-stream.conf";
-  secrets.keys = [
+  secrets.keys = {
-    {
+    "netdata-stream.conf" = {
-      dest = "netdata-stream.conf";
      user = config.services.netdata.user;
      group = config.services.netdata.group;
      permissions = "0400";
@@ -138,15 +137,14 @@
            destination = ${config.myEnv.monitoring.netdata_aggregator}
            api key = ${config.myEnv.monitoring.netdata_keys.eldiron}
      '';
-    }
+    };
-    {
+    "zrepl_backup/identity" = {
-      dest = "zrepl_backup/identity";
      user = "root";
      group = "root";
      permissions = "0400";
      text = config.myEnv.zrepl_backup.ssh_key.private;
-    }
+    };
-  ];
+  };
  programs.ssh.knownHosts.dilion = {
    hostNames = ["dilion.immae.eu"];
    publicKey = let
diff --git a/modules/private/system/monitoring-1.nix b/modules/private/system/monitoring-1.nix
index 91d30fd..dea5f45 100644
--- a/modules/private/system/monitoring-1.nix
+++ b/modules/private/system/monitoring-1.nix
@@ -45,9 +45,8 @@
  networking.firewall.allowedTCPPorts = [ 19999 ];
  environment.etc."netdata/stream.conf".source = config.secrets.fullPaths."netdata-stream.conf";
-  secrets.keys = [
+  secrets.keys = {
-    {
+    "netdata-stream.conf" = {
-      dest = "netdata-stream.conf";
      user = config.services.netdata.user;
      group = config.services.netdata.group;
      permissions = "0400";
@@ -58,8 +57,8 @@
            default memory = ram
            health enabled by default = auto
      '') config.myEnv.monitoring.netdata_keys);
-    }
+    };
-  ];
+  };
  users.users."${config.services.netdata.user}".extraGroups = [ "keys" ];
  # This value determines the NixOS release with which your system is
  # to be compatible, in order to avoid breaking some software such as
diff --git a/modules/private/system/quatresaisons.nix b/modules/private/system/quatresaisons.nix
index 491e215..82db70f 100644
--- a/modules/private/system/quatresaisons.nix
+++ b/modules/private/system/quatresaisons.nix
@@ -254,14 +254,12 @@ in
    '';
  };
-  secrets.keys = [
+  secrets.keys = {
-    {
+    "ldap/sync_password" = {
-      dest = "ldap/sync_password";
      permissions = "0400";
      text = serverSpecificConfig.ldap_sync_password;
-    }
+    };
-    {
+    "ldap/ldaptree.ldif" = {
-      dest = "ldap/ldaptree.ldif";
      permissions = "0400";
      text = serverSpecificConfig.ldap_service_users
        + (builtins.concatStringsSep "\n" (lib.mapAttrsToList (n: v: ''
@@ -272,8 +270,8 @@ in
        sn: ${n}
        uid: ${n}
      '') normalUsers));
-    }
+    };
-  ];
+  };
  myServices.monitoring.enable = true;
  myServices.certificates.enable = true;
diff --git a/modules/private/system/quatresaisons/databases.nix b/modules/private/system/quatresaisons/databases.nix
index 68ce274..f7b27e0 100644
--- a/modules/private/system/quatresaisons/databases.nix
+++ b/modules/private/system/quatresaisons/databases.nix
@@ -9,16 +9,14 @@
    services.postgresql.ensureUsers = [
      { name = "naemon"; }
    ];
-    secrets.keys = [
+    secrets.keys = {
-      {
+      "ldap/password" = {
-        dest = "ldap/password";
        permissions = "0400";
        user = "openldap";
        group = "openldap";
        text = "rootpw      ${serverSpecificConfig.ldap_root_pw}";
-      }
+      };
-      {
+      "webapps/tools-ldap" = {
-        dest = "webapps/tools-ldap";
        user = "wwwrun";
        group = "wwwrun";
        permissions = "0400";
@@ -42,8 +40,8 @@
          $servers->setValue('login','attr','uid');
          $servers->setValue('login','fallback_dn',true);
        '';
-      }
+      };
-    ];
+    };
    users.users.openldap.extraGroups = [ "keys" ];
    services.openldap = {
diff --git a/modules/private/tasks/default.nix b/modules/private/tasks/default.nix
index b3f1b7b..ac2aa21 100644
--- a/modules/private/tasks/default.nix
+++ b/modules/private/tasks/default.nix
@@ -95,9 +95,8 @@ in {
        '';
    };
-    secrets.keys = [
+    secrets.keys = {
-      {
+      "webapps/tools-taskwarrior-web" = {
-        dest = "webapps/tools-taskwarrior-web";
        user = "wwwrun";
        group = "wwwrun";
        permissions = "0400";
@@ -110,9 +109,8 @@ in {
            SetEnv TASKD_LDAP_BASE     "${env.ldap.base}"
            SetEnv TASKD_LDAP_FILTER   "${env.ldap.filter}"
          '';
-      }
+      };
-    ] ++ (lib.mapAttrsToList (name: userConfig: {
+    } // (lib.mapAttrs' (name: userConfig: lib.nameValuePair "webapps/tools-taskwarrior/${name}-taskrc" {
-      dest = "webapps/tools-taskwarrior/${name}-taskrc";
      inherit user group;
      permissions = "0400";
      text = let
diff --git a/modules/private/vpn/default.nix b/modules/private/vpn/default.nix
index a9051af..d4b197d 100644
--- a/modules/private/vpn/default.nix
+++ b/modules/private/vpn/default.nix
@@ -8,22 +8,20 @@ in
  };
  config = lib.mkIf cfg.enable {
-    secrets.keys = [
+    secrets.keys = {
-      {
+      "tinc/key.priv" = {
-        dest = "tinc/key.priv";
        user = "root";
        group = "root";
        permissions = "0400";
        text = config.myEnv.vpn.eldiron.privateKey;
-      }
+      };
-      {
+      "tinc/key.pub" = {
-        dest = "tinc/key.pub";
        user = "root";
        group = "root";
        permissions = "0400";
        text = config.myEnv.vpn.eldiron.publicKey;
-      }
+      };
-    ];
+    };
    networking.firewall.allowedTCPPorts = [ 655 1194 ];
    system.activationScripts.tinc = let
      configFiles = pkgs.runCommand "tinc-files" {
diff --git a/modules/private/websites/chloe/integration.nix b/modules/private/websites/chloe/integration.nix
index ffae6ec..c4b79f8 100644
--- a/modules/private/websites/chloe/integration.nix
+++ b/modules/private/websites/chloe/integration.nix
@@ -15,29 +15,26 @@ in {
  config = lib.mkIf cfg.enable {
    services.duplyBackup.profiles.chloe_integration.rootDir = app.varDir;
-    secrets.keys = [
+    secrets.keys."websites/chloe/integration" = {
-      {
+      user = apacheUser;
-        dest = "websites/chloe/integration";
+      group = apacheGroup;
-        user = apacheUser;
+      permissions = "0400";
-        group = apacheGroup;
+      text = ''
-        permissions = "0400";
+        SetEnv SPIP_CONFIG_DIR     "${./config}"
-        text = ''
+        SetEnv SPIP_VAR_DIR        "${app.varDir}"
-          SetEnv SPIP_CONFIG_DIR     "${./config}"
+        SetEnv SPIP_SITE           "chloe-${app.environment}"
-          SetEnv SPIP_VAR_DIR        "${app.varDir}"
+        SetEnv SPIP_LDAP_BASE      "dc=immae,dc=eu"
-          SetEnv SPIP_SITE           "chloe-${app.environment}"
+        SetEnv SPIP_LDAP_HOST      "ldaps://ldap.immae.eu"
-          SetEnv SPIP_LDAP_BASE      "dc=immae,dc=eu"
+        SetEnv SPIP_LDAP_SEARCH_DN "${ccfg.ldap.dn}"
-          SetEnv SPIP_LDAP_HOST      "ldaps://ldap.immae.eu"
+        SetEnv SPIP_LDAP_SEARCH_PW "${ccfg.ldap.password}"
-          SetEnv SPIP_LDAP_SEARCH_DN "${ccfg.ldap.dn}"
+        SetEnv SPIP_LDAP_SEARCH    "${ccfg.ldap.filter}"
-          SetEnv SPIP_LDAP_SEARCH_PW "${ccfg.ldap.password}"
+        SetEnv SPIP_MYSQL_HOST     "${ccfg.mysql.host}"
-          SetEnv SPIP_LDAP_SEARCH    "${ccfg.ldap.filter}"
+        SetEnv SPIP_MYSQL_PORT     "${ccfg.mysql.port}"
-          SetEnv SPIP_MYSQL_HOST     "${ccfg.mysql.host}"
+        SetEnv SPIP_MYSQL_DB       "${ccfg.mysql.database}"
-          SetEnv SPIP_MYSQL_PORT     "${ccfg.mysql.port}"
+        SetEnv SPIP_MYSQL_USER     "${ccfg.mysql.user}"
-          SetEnv SPIP_MYSQL_DB       "${ccfg.mysql.database}"
+        SetEnv SPIP_MYSQL_PASSWORD "${ccfg.mysql.password}"
-          SetEnv SPIP_MYSQL_USER     "${ccfg.mysql.user}"
+      '';
-          SetEnv SPIP_MYSQL_PASSWORD "${ccfg.mysql.password}"
+    };
-        '';
-      }
-    ];
    systemd.services.phpfpm-chloe_integration.after = lib.mkAfter [ "mysql.service" ];
    systemd.services.phpfpm-chloe_integration.wants = [ "mysql.service" ];
    services.phpfpm.pools.chloe_integration = {
diff --git a/modules/private/websites/chloe/production.nix b/modules/private/websites/chloe/production.nix
index 7f8f1de..92ae05b 100644
--- a/modules/private/websites/chloe/production.nix
+++ b/modules/private/websites/chloe/production.nix
@@ -16,29 +16,26 @@ in {
  config = lib.mkIf cfg.enable {
    services.duplyBackup.profiles.chloe_production.rootDir = app.varDir;
    services.duplyBackup.profiles.chloe_production.remotes = ["eriomem" "ovh"];
-    secrets.keys = [
+    secrets.keys."websites/chloe/production" = {
-      {
+      user = apacheUser;
-        dest = "websites/chloe/production";
+      group = apacheGroup;
-        user = apacheUser;
+      permissions = "0400";
-        group = apacheGroup;
+      text = ''
-        permissions = "0400";
+        SetEnv SPIP_CONFIG_DIR     "${./config}"
-        text = ''
+        SetEnv SPIP_VAR_DIR        "${app.varDir}"
-          SetEnv SPIP_CONFIG_DIR     "${./config}"
+        SetEnv SPIP_SITE           "chloe-${app.environment}"
-          SetEnv SPIP_VAR_DIR        "${app.varDir}"
+        SetEnv SPIP_LDAP_BASE      "dc=immae,dc=eu"
-          SetEnv SPIP_SITE           "chloe-${app.environment}"
+        SetEnv SPIP_LDAP_HOST      "ldaps://ldap.immae.eu"
-          SetEnv SPIP_LDAP_BASE      "dc=immae,dc=eu"
+        SetEnv SPIP_LDAP_SEARCH_DN "${ccfg.ldap.dn}"
-          SetEnv SPIP_LDAP_HOST      "ldaps://ldap.immae.eu"
+        SetEnv SPIP_LDAP_SEARCH_PW "${ccfg.ldap.password}"
-          SetEnv SPIP_LDAP_SEARCH_DN "${ccfg.ldap.dn}"
+        SetEnv SPIP_LDAP_SEARCH    "${ccfg.ldap.filter}"
-          SetEnv SPIP_LDAP_SEARCH_PW "${ccfg.ldap.password}"
+        SetEnv SPIP_MYSQL_HOST     "${ccfg.mysql.host}"
-          SetEnv SPIP_LDAP_SEARCH    "${ccfg.ldap.filter}"
+        SetEnv SPIP_MYSQL_PORT     "${ccfg.mysql.port}"
-          SetEnv SPIP_MYSQL_HOST     "${ccfg.mysql.host}"
+        SetEnv SPIP_MYSQL_DB       "${ccfg.mysql.database}"
-          SetEnv SPIP_MYSQL_PORT     "${ccfg.mysql.port}"
+        SetEnv SPIP_MYSQL_USER     "${ccfg.mysql.user}"
-          SetEnv SPIP_MYSQL_DB       "${ccfg.mysql.database}"
+        SetEnv SPIP_MYSQL_PASSWORD "${ccfg.mysql.password}"
-          SetEnv SPIP_MYSQL_USER     "${ccfg.mysql.user}"
+      '';
-          SetEnv SPIP_MYSQL_PASSWORD "${ccfg.mysql.password}"
+    };
-        '';
-      }
-    ];
    services.webstats.sites = [ { name = "osteopathe-cc.fr"; } ];
    systemd.services.phpfpm-chloe_production.after = lib.mkAfter [ "mysql.service" ];
diff --git a/modules/private/websites/connexionswing/integration.nix b/modules/private/websites/connexionswing/integration.nix
index f5b1a16..1b3587a 100644
--- a/modules/private/websites/connexionswing/integration.nix
+++ b/modules/private/websites/connexionswing/integration.nix
@@ -47,31 +47,28 @@ in {
      phpPackage = pkgs.php72;
    };
-    secrets.keys = [
+    secrets.keys."websites/connexionswing/integration" = {
-      {
+      user = config.services.httpd.Inte.user;
-        dest = "websites/connexionswing/integration";
+      group = config.services.httpd.Inte.group;
-        user = config.services.httpd.Inte.user;
+      permissions = "0400";
-        group = config.services.httpd.Inte.group;
+      text = ''
-        permissions = "0400";
+        # This file is auto-generated during the composer install
-        text = ''
+        parameters:
-          # This file is auto-generated during the composer install
+            database_host: ${secrets.mysql.host}
-          parameters:
+            database_port: ${secrets.mysql.port}
-              database_host: ${secrets.mysql.host}
+            database_name: ${secrets.mysql.database}
-              database_port: ${secrets.mysql.port}
+            database_user: ${secrets.mysql.user}
-              database_name: ${secrets.mysql.database}
+            database_password: ${secrets.mysql.password}
-              database_user: ${secrets.mysql.user}
+            database_server_version: ${pkgs.mariadb.mysqlVersion}
-              database_password: ${secrets.mysql.password}
+            mailer_transport: sendmail
-              database_server_version: ${pkgs.mariadb.mysqlVersion}
+            mailer_host: null
-              mailer_transport: sendmail
+            mailer_user: null
-              mailer_host: null
+            mailer_password: null
-              mailer_user: null
+            subscription_email: ${secrets.email}
-              mailer_password: null
+            allow_robots: true
-              subscription_email: ${secrets.email}
+            secret: ${secrets.secret}
-              allow_robots: true
+      '';
-              secret: ${secrets.secret}
+    };
-        '';
-      }
-    ];
    services.websites.env.integration.vhostConfs.connexionswing_integration = {
      certName    = "integration";
diff --git a/modules/private/websites/connexionswing/production.nix b/modules/private/websites/connexionswing/production.nix
index f6a059d..981e95e 100644
--- a/modules/private/websites/connexionswing/production.nix
+++ b/modules/private/websites/connexionswing/production.nix
@@ -48,35 +48,32 @@ in {
      phpPackage = pkgs.php72;
    };
-    secrets.keys = [
+    secrets.keys."websites/connexionswing/production" = {
-      {
+      user = config.services.httpd.Prod.user;
-        dest = "websites/connexionswing/production";
+      group = config.services.httpd.Prod.group;
-        user = config.services.httpd.Prod.user;
+      permissions = "0400";
-        group = config.services.httpd.Prod.group;
+      text = ''
-        permissions = "0400";
+        # This file is auto-generated during the composer install
-        text = ''
+        parameters:
-          # This file is auto-generated during the composer install
+            database_host: ${secrets.mysql.host}
-          parameters:
+            database_port: ${secrets.mysql.port}
-              database_host: ${secrets.mysql.host}
+            database_name: ${secrets.mysql.database}
-              database_port: ${secrets.mysql.port}
+            database_user: ${secrets.mysql.user}
-              database_name: ${secrets.mysql.database}
+            database_password: ${secrets.mysql.password}
-              database_user: ${secrets.mysql.user}
+            database_server_version: ${pkgs.mariadb.mysqlVersion}
-              database_password: ${secrets.mysql.password}
+            mailer_transport: sendmail
-              database_server_version: ${pkgs.mariadb.mysqlVersion}
+            mailer_host: null
-              mailer_transport: sendmail
+            mailer_user: null
-              mailer_host: null
+            mailer_password: null
-              mailer_user: null
+            subscription_email: ${secrets.email}
-              mailer_password: null
+            allow_robots: true
-              subscription_email: ${secrets.email}
+            secret: ${secrets.secret}
-              allow_robots: true
+        services:
-              secret: ${secrets.secret}
+          swiftmailer.mailer.default.transport:
-          services:
+              class:     Swift_SendmailTransport
-            swiftmailer.mailer.default.transport:
+              arguments: ['/run/wrappers/bin/sendmail -bs']
-                class:     Swift_SendmailTransport
+      '';
-                arguments: ['/run/wrappers/bin/sendmail -bs']
+    };
-        '';
-      }
-    ];
    services.websites.env.production.vhostConfs.connexionswing_production = {
      certName     = "connexionswing";
diff --git a/modules/private/websites/default.nix b/modules/private/websites/default.nix
index 8fb6a4d..e819324 100644
--- a/modules/private/websites/default.nix
+++ b/modules/private/websites/default.nix
@@ -109,8 +109,7 @@ in
    users.users.wwwrun.extraGroups = [ "keys" ];
    networking.firewall.allowedTCPPorts = [ 80 443 ];
-    secrets.keys = [{
+    secrets.keys."apache-ldap" = {
-      dest = "apache-ldap";
      user = "wwwrun";
      group = "wwwrun";
      permissions = "0400";
@@ -126,7 +125,7 @@ in
          </IfModule>
        </Macro>
        '';
-    }];
+    };
    system.activationScripts = {
      httpd = ''
diff --git a/modules/private/websites/florian/app.nix b/modules/private/websites/florian/app.nix
index 14358d8..87e622a 100644
--- a/modules/private/websites/florian/app.nix
+++ b/modules/private/websites/florian/app.nix
@@ -46,18 +46,16 @@ in {
      phpPackage = pkgs.php72;
    };
-    secrets.keys = [
+    secrets.keys = {
-      {
+      "websites/florian/app_passwords" = {
-        dest = "websites/florian/app_passwords";
        user = config.services.httpd.Inte.user;
        group = config.services.httpd.Inte.group;
        permissions = "0400";
        text = ''
          invite:${secrets.invite_passwords}
        '';
-      }
+      };
-      {
+      "websites/florian/app" = {
-        dest = "websites/florian/app";
        user = config.services.httpd.Inte.user;
        group = config.services.httpd.Inte.group;
        permissions = "0400";
@@ -75,8 +73,8 @@ in {
            mailer_password: null
            secret: ${secrets.secret}
        '';
-      }
+      };
-    ];
+    };
    services.websites.env.integration.modules = adminer.apache.modules;
    services.websites.env.integration.vhostConfs.florian_app = {
diff --git a/modules/private/websites/immae/temp.nix b/modules/private/websites/immae/temp.nix
index 8518283..61ed9cf 100644
--- a/modules/private/websites/immae/temp.nix
+++ b/modules/private/websites/immae/temp.nix
@@ -28,24 +28,21 @@ in {
      '' ];
    };
-    secrets.keys = [
+    secrets.keys."webapps/surfer" = {
-      {
+      permissions = "0400";
-        dest = "webapps/surfer";
+      user = "wwwrun";
-        permissions = "0400";
+      group = "wwwrun";
-        user = "wwwrun";
+      text = ''
-        group = "wwwrun";
+        CLOUDRON_LDAP_URL=ldaps://${env.ldap.host}
-        text = ''
+        CLOUDRON_LDAP_USERS_BASE_DN=${env.ldap.base}
-          CLOUDRON_LDAP_URL=ldaps://${env.ldap.host}
+        TOKENSTORE_FILE=/var/lib/surfer/tokens.json
-          CLOUDRON_LDAP_USERS_BASE_DN=${env.ldap.base}
+        CLOUDRON_LDAP_BIND_DN=${env.ldap.dn}
-          TOKENSTORE_FILE=/var/lib/surfer/tokens.json
+        CLOUDRON_LDAP_BIND_PASSWORD=${env.ldap.password}
-          CLOUDRON_LDAP_BIND_DN=${env.ldap.dn}
+        CLOUDRON_LDAP_USERS_BASE_DN=${env.ldap.base}
-          CLOUDRON_LDAP_BIND_PASSWORD=${env.ldap.password}
+        CLOUDRON_LDAP_FILTER="${env.ldap.filter}"
-          CLOUDRON_LDAP_USERS_BASE_DN=${env.ldap.base}
+        LISTEN=/run/surfer/listen.sock
-          CLOUDRON_LDAP_FILTER="${env.ldap.filter}"
+      '';
-          LISTEN=/run/surfer/listen.sock
+    };
-        '';
-      }
-    ];
    systemd.services.surfer = {
      description = "Surfer";
diff --git a/modules/private/websites/isabelle/aten_integration.nix b/modules/private/websites/isabelle/aten_integration.nix
index 6f8f985..899ee66 100644
--- a/modules/private/websites/isabelle/aten_integration.nix
+++ b/modules/private/websites/isabelle/aten_integration.nix
@@ -41,8 +41,7 @@ in {
      phpPackage = pkgs.php72;
    };
-    secrets.keys = [{
+    secrets.keys."websites/isabelle/aten_integration" = {
-      dest = "websites/isabelle/aten_integration";
      user = config.services.httpd.Inte.user;
      group = config.services.httpd.Inte.group;
      permissions = "0400";
@@ -56,7 +55,7 @@ in {
        SetEnv APP_SECRET   "${secrets.secret}"
        SetEnv DATABASE_URL "${psql_url}"
        '';
-    }];
+    };
    services.websites.env.integration.vhostConfs.isabelle_aten_integration = {
      certName    = "integration";
      addToCerts  = true;
diff --git a/modules/private/websites/isabelle/aten_production.nix b/modules/private/websites/isabelle/aten_production.nix
index 3671712..b8d12b9 100644
--- a/modules/private/websites/isabelle/aten_production.nix
+++ b/modules/private/websites/isabelle/aten_production.nix
@@ -42,8 +42,7 @@ in {
      phpPackage = pkgs.php72;
    };
-    secrets.keys = [{
+    secrets.keys."websites/isabelle/aten_production" = {
-      dest = "websites/isabelle/aten_production";
      user = config.services.httpd.Prod.user;
      group = config.services.httpd.Prod.group;
      permissions = "0400";
@@ -57,7 +56,7 @@ in {
        SetEnv APP_SECRET   "${secrets.secret}"
        SetEnv DATABASE_URL "${psql_url}"
        '';
-    }];
+    };
    services.websites.env.production.vhostConfs.isabelle_aten_production = {
      certName     = "isabelle";
      certMainHost = "aten.pro";
diff --git a/modules/private/websites/isabelle/iridologie.nix b/modules/private/websites/isabelle/iridologie.nix
index 14296bf..decda36 100644
--- a/modules/private/websites/isabelle/iridologie.nix
+++ b/modules/private/websites/isabelle/iridologie.nix
@@ -18,29 +18,26 @@ in {
  config = lib.mkIf cfg.enable {
    services.duplyBackup.profiles.isabelle_iridologie.rootDir = app.varDir;
    services.duplyBackup.profiles.isabelle_iridologie.remotes = ["eriomem" "ovh"];
-    secrets.keys = [
+    secrets.keys."websites/isabelle/iridologie" = {
-      {
+      user = apacheUser;
-        dest = "websites/isabelle/iridologie";
+      group = apacheGroup;
-        user = apacheUser;
+      permissions = "0400";
-        group = apacheGroup;
+      text = ''
-        permissions = "0400";
+        SetEnv SPIP_CONFIG_DIR     "${./config}"
-        text = ''
+        SetEnv SPIP_VAR_DIR        "${app.varDir}"
-          SetEnv SPIP_CONFIG_DIR     "${./config}"
+        SetEnv SPIP_SITE           "iridologie-${app.environment}"
-          SetEnv SPIP_VAR_DIR        "${app.varDir}"
+        SetEnv SPIP_LDAP_BASE      "dc=immae,dc=eu"
-          SetEnv SPIP_SITE           "iridologie-${app.environment}"
+        SetEnv SPIP_LDAP_HOST      "ldaps://ldap.immae.eu"
-          SetEnv SPIP_LDAP_BASE      "dc=immae,dc=eu"
+        SetEnv SPIP_LDAP_SEARCH_DN "${icfg.ldap.dn}"
-          SetEnv SPIP_LDAP_HOST      "ldaps://ldap.immae.eu"
+        SetEnv SPIP_LDAP_SEARCH_PW "${icfg.ldap.password}"
-          SetEnv SPIP_LDAP_SEARCH_DN "${icfg.ldap.dn}"
+        SetEnv SPIP_LDAP_SEARCH    "${icfg.ldap.filter}"
-          SetEnv SPIP_LDAP_SEARCH_PW "${icfg.ldap.password}"
+        SetEnv SPIP_MYSQL_HOST     "${icfg.mysql.host}"
-          SetEnv SPIP_LDAP_SEARCH    "${icfg.ldap.filter}"
+        SetEnv SPIP_MYSQL_PORT     "${icfg.mysql.port}"
-          SetEnv SPIP_MYSQL_HOST     "${icfg.mysql.host}"
+        SetEnv SPIP_MYSQL_DB       "${icfg.mysql.database}"
-          SetEnv SPIP_MYSQL_PORT     "${icfg.mysql.port}"
+        SetEnv SPIP_MYSQL_USER     "${icfg.mysql.user}"
-          SetEnv SPIP_MYSQL_DB       "${icfg.mysql.database}"
+        SetEnv SPIP_MYSQL_PASSWORD "${icfg.mysql.password}"
-          SetEnv SPIP_MYSQL_USER     "${icfg.mysql.user}"
+      '';
-          SetEnv SPIP_MYSQL_PASSWORD "${icfg.mysql.password}"
+    };
-        '';
-      }
-    ];
    services.webstats.sites = [ { name = "iridologie.icommandeur.org"; } ];
    systemd.services.phpfpm-isabelle_iridologie.after = lib.mkAfter [ "mysql.service" ];
diff --git a/modules/private/websites/jerome/naturaloutil.nix b/modules/private/websites/jerome/naturaloutil.nix
index 95d7e78..0974ce3 100644
--- a/modules/private/websites/jerome/naturaloutil.nix
+++ b/modules/private/websites/jerome/naturaloutil.nix
@@ -15,8 +15,7 @@ in {
    security.acme.certs."ftp".extraDomains."naturaloutil.immae.eu" = null;
-    secrets.keys = [{
+    secrets.keys."websites/jerome/naturaloutil" = {
-      dest = "websites/jerome/naturaloutil";
      user = apacheUser;
      group = apacheGroup;
      permissions = "0400";
@@ -35,7 +34,7 @@ in {
        $database = connect_db($db, $mysql_server, $mysql_base, $mysql_user, $mysql_password);
        ?>
      '';
-    }];
+    };
    system.activationScripts.jerome_naturaloutil = {
      deps = [ "httpd" ];
      text = ''
diff --git a/modules/private/websites/ludivine/integration.nix b/modules/private/websites/ludivine/integration.nix
index 4357b93..cfef385 100644
--- a/modules/private/websites/ludivine/integration.nix
+++ b/modules/private/websites/ludivine/integration.nix
@@ -50,44 +50,41 @@ in {
      phpPackage = pkgs.php72;
    };
-    secrets.keys = [
+    secrets.keys."websites/ludivine/integration" = {
-      {
+      user = config.services.httpd.Inte.user;
-        dest = "websites/ludivine/integration";
+      group = config.services.httpd.Inte.group;
-        user = config.services.httpd.Inte.user;
+      permissions = "0400";
-        group = config.services.httpd.Inte.group;
+      text = ''
-        permissions = "0400";
+        # This file is auto-generated during the composer install
-        text = ''
+        parameters:
-          # This file is auto-generated during the composer install
+            database_host: ${secrets.mysql.host}
-          parameters:
+            database_port: ${secrets.mysql.port}
-              database_host: ${secrets.mysql.host}
+            database_name: ${secrets.mysql.database}
-              database_port: ${secrets.mysql.port}
+            database_user: ${secrets.mysql.user}
-              database_name: ${secrets.mysql.database}
+            database_password: ${secrets.mysql.password}
-              database_user: ${secrets.mysql.user}
+            database_server_version: ${pkgs.mariadb.mysqlVersion}
-              database_password: ${secrets.mysql.password}
+            mailer_transport: smtp
-              database_server_version: ${pkgs.mariadb.mysqlVersion}
+            mailer_host: 127.0.0.1
-              mailer_transport: smtp
+            mailer_user: null
-              mailer_host: 127.0.0.1
+            mailer_password: null
-              mailer_user: null
+            secret: ${secrets.secret}
-              mailer_password: null
+            ldap_host: ldap.immae.eu
-              secret: ${secrets.secret}
+            ldap_port: 636
-              ldap_host: ldap.immae.eu
+            ldap_version: 3
-              ldap_port: 636
+            ldap_ssl: true
-              ldap_version: 3
+            ldap_tls: false
-              ldap_ssl: true
+            ldap_user_bind: 'uid={username},ou=users,dc=immae,dc=eu'
-              ldap_tls: false
+            ldap_base_dn: 'dc=immae,dc=eu'
-              ldap_user_bind: 'uid={username},ou=users,dc=immae,dc=eu'
+            ldap_search_dn: '${secrets.ldap.dn}'
-              ldap_base_dn: 'dc=immae,dc=eu'
+            ldap_search_password: '${secrets.ldap.password}'
-              ldap_search_dn: '${secrets.ldap.dn}'
+            ldap_search_filter: '${secrets.ldap.filter}'
-              ldap_search_password: '${secrets.ldap.password}'
+        leapt_im:
-              ldap_search_filter: '${secrets.ldap.filter}'
+            binary_path: ${pkgs.imagemagick}/bin
-          leapt_im:
+        assetic:
-              binary_path: ${pkgs.imagemagick}/bin
+            sass: ${pkgs.sass}/bin/sass
-          assetic:
+            ruby: ${pkgs.ruby}/bin/ruby
-              sass: ${pkgs.sass}/bin/sass
+      '';
-              ruby: ${pkgs.ruby}/bin/ruby
+    };
-        '';
-      }
-    ];
    services.websites.env.integration.vhostConfs.ludivine_integration = {
      certName    = "integration";
diff --git a/modules/private/websites/ludivine/production.nix b/modules/private/websites/ludivine/production.nix
index 3a9895d..73b63a2 100644
--- a/modules/private/websites/ludivine/production.nix
+++ b/modules/private/websites/ludivine/production.nix
@@ -53,44 +53,41 @@ in {
      phpPackage = pkgs.php72;
    };
-    secrets.keys = [
+    secrets.keys."websites/ludivine/production" = {
-      {
+      user = config.services.httpd.Prod.user;
-        dest = "websites/ludivine/production";
+      group = config.services.httpd.Prod.group;
-        user = config.services.httpd.Prod.user;
+      permissions = "0400";
-        group = config.services.httpd.Prod.group;
+      text = ''
-        permissions = "0400";
+        # This file is auto-generated during the composer install
-        text = ''
+        parameters:
-          # This file is auto-generated during the composer install
+            database_host: ${secrets.mysql.host}
-          parameters:
+            database_port: ${secrets.mysql.port}
-              database_host: ${secrets.mysql.host}
+            database_name: ${secrets.mysql.database}
-              database_port: ${secrets.mysql.port}
+            database_user: ${secrets.mysql.user}
-              database_name: ${secrets.mysql.database}
+            database_password: ${secrets.mysql.password}
-              database_user: ${secrets.mysql.user}
+            database_server_version: ${pkgs.mariadb.mysqlVersion}
-              database_password: ${secrets.mysql.password}
+            mailer_transport: smtp
-              database_server_version: ${pkgs.mariadb.mysqlVersion}
+            mailer_host: 127.0.0.1
-              mailer_transport: smtp
+            mailer_user: null
-              mailer_host: 127.0.0.1
+            mailer_password: null
-              mailer_user: null
+            secret: ${secrets.secret}
-              mailer_password: null
+            ldap_host: ldap.immae.eu
-              secret: ${secrets.secret}
+            ldap_port: 636
-              ldap_host: ldap.immae.eu
+            ldap_version: 3
-              ldap_port: 636
+            ldap_ssl: true
-              ldap_version: 3
+            ldap_tls: false
-              ldap_ssl: true
+            ldap_user_bind: 'uid={username},ou=users,dc=immae,dc=eu'
-              ldap_tls: false
+            ldap_base_dn: 'dc=immae,dc=eu'
-              ldap_user_bind: 'uid={username},ou=users,dc=immae,dc=eu'
+            ldap_search_dn: '${secrets.ldap.dn}'
-              ldap_base_dn: 'dc=immae,dc=eu'
+            ldap_search_password: '${secrets.ldap.password}'
-              ldap_search_dn: '${secrets.ldap.dn}'
+            ldap_search_filter: '${secrets.ldap.filter}'
-              ldap_search_password: '${secrets.ldap.password}'
+        leapt_im:
-              ldap_search_filter: '${secrets.ldap.filter}'
+            binary_path: ${pkgs.imagemagick}/bin
-          leapt_im:
+        assetic:
-              binary_path: ${pkgs.imagemagick}/bin
+            sass: ${pkgs.sass}/bin/sass
-          assetic:
+            ruby: ${pkgs.ruby}/bin/ruby
-              sass: ${pkgs.sass}/bin/sass
+      '';
-              ruby: ${pkgs.ruby}/bin/ruby
+    };
-        '';
-      }
-    ];
    services.websites.env.production.vhostConfs.ludivine_production = {
      certName     = "ludivine";
diff --git a/modules/private/websites/piedsjaloux/integration.nix b/modules/private/websites/piedsjaloux/integration.nix
index dc98900..f501eba 100644
--- a/modules/private/websites/piedsjaloux/integration.nix
+++ b/modules/private/websites/piedsjaloux/integration.nix
@@ -52,32 +52,29 @@ in {
      phpPackage = pkgs.php72;
    };
-    secrets.keys = [
+    secrets.keys."websites/piedsjaloux/integration" = {
-      {
+      user = config.services.httpd.Inte.user;
-        dest = "websites/piedsjaloux/integration";
+      group = config.services.httpd.Inte.group;
-        user = config.services.httpd.Inte.user;
+      permissions = "0400";
-        group = config.services.httpd.Inte.group;
+      text = ''
-        permissions = "0400";
+        # This file is auto-generated during the composer install
-        text = ''
+        parameters:
-          # This file is auto-generated during the composer install
+            database_host: ${secrets.mysql.host}
-          parameters:
+            database_port: ${secrets.mysql.port}
-              database_host: ${secrets.mysql.host}
+            database_name: ${secrets.mysql.database}
-              database_port: ${secrets.mysql.port}
+            database_user: ${secrets.mysql.user}
-              database_name: ${secrets.mysql.database}
+            database_password: ${secrets.mysql.password}
-              database_user: ${secrets.mysql.user}
+            database_server_version: ${pkgs.mariadb.mysqlVersion}
-              database_password: ${secrets.mysql.password}
+            mailer_transport: smtp
-              database_server_version: ${pkgs.mariadb.mysqlVersion}
+            mailer_host: 127.0.0.1
-              mailer_transport: smtp
+            mailer_user: null
-              mailer_host: 127.0.0.1
+            mailer_password: null
-              mailer_user: null
+            secret: ${secrets.secret}
-              mailer_password: null
+            pdflatex: "${texlive}/bin/pdflatex"
-              secret: ${secrets.secret}
+        leapt_im:
-              pdflatex: "${texlive}/bin/pdflatex"
+            binary_path: ${pkgs.imagemagick}/bin
-          leapt_im:
+      '';
-              binary_path: ${pkgs.imagemagick}/bin
+    };
-        '';
-      }
-    ];
    services.websites.env.integration.vhostConfs.piedsjaloux_integration = {
      certName     = "integration";
diff --git a/modules/private/websites/piedsjaloux/production.nix b/modules/private/websites/piedsjaloux/production.nix
index e12b046..fed5a0f 100644
--- a/modules/private/websites/piedsjaloux/production.nix
+++ b/modules/private/websites/piedsjaloux/production.nix
@@ -55,32 +55,29 @@ in {
      phpPackage = pkgs.php72;
    };
-    secrets.keys = [
+    secrets.keys."websites/piedsjaloux/production" = {
-      {
+      user = config.services.httpd.Prod.user;
-        dest = "websites/piedsjaloux/production";
+      group = config.services.httpd.Prod.group;
-        user = config.services.httpd.Prod.user;
+      permissions = "0400";
-        group = config.services.httpd.Prod.group;
+      text = ''
-        permissions = "0400";
+        # This file is auto-generated during the composer install
-        text = ''
+        parameters:
-          # This file is auto-generated during the composer install
+            database_host: ${secrets.mysql.host}
-          parameters:
+            database_port: ${secrets.mysql.port}
-              database_host: ${secrets.mysql.host}
+            database_name: ${secrets.mysql.database}
-              database_port: ${secrets.mysql.port}
+            database_user: ${secrets.mysql.user}
-              database_name: ${secrets.mysql.database}
+            database_password: ${secrets.mysql.password}
-              database_user: ${secrets.mysql.user}
+            database_server_version: ${pkgs.mariadb.mysqlVersion}
-              database_password: ${secrets.mysql.password}
+            mailer_transport: smtp
-              database_server_version: ${pkgs.mariadb.mysqlVersion}
+            mailer_host: 127.0.0.1
-              mailer_transport: smtp
+            mailer_user: null
-              mailer_host: 127.0.0.1
+            mailer_password: null
-              mailer_user: null
+            secret: ${secrets.secret}
-              mailer_password: null
+            pdflatex: "${texlive}/bin/pdflatex"
-              secret: ${secrets.secret}
+        leapt_im:
-              pdflatex: "${texlive}/bin/pdflatex"
+            binary_path: ${pkgs.imagemagick}/bin
-          leapt_im:
+      '';
-              binary_path: ${pkgs.imagemagick}/bin
+    };
-        '';
-      }
-    ];
    services.websites.env.production.vhostConfs.piedsjaloux_production = {
      certName     = "piedsjaloux";
diff --git a/modules/private/websites/richie/production.nix b/modules/private/websites/richie/production.nix
index 2d85175..3efa9f0 100644
--- a/modules/private/websites/richie/production.nix
+++ b/modules/private/websites/richie/production.nix
@@ -29,8 +29,7 @@ in
    services.duplyBackup.profiles.richie_production.remotes = ["eriomem" "ovh"];
    services.webstats.sites = [ { name = "europe-richie.org"; } ];
-    secrets.keys = [{
+    secrets.keys."websites/richie/production" = {
-      dest = "websites/richie/production";
      user = apacheUser;
      group = apacheGroup;
      permissions = "0400";
@@ -48,7 +47,7 @@ in
        $smtp_mailer->Auth('${smtp_mailer.user}', '${smtp_mailer.password}');
        ?>
        '';
-    }];
+    };
    services.websites.webappDirs.richie_production = richieSrc;
    system.activationScripts.richie_production = {
      deps = [ "httpd" ];
diff --git a/modules/private/websites/syden/peertube.nix b/modules/private/websites/syden/peertube.nix
index aa465d7..4036eac 100644
--- a/modules/private/websites/syden/peertube.nix
+++ b/modules/private/websites/syden/peertube.nix
@@ -23,8 +23,7 @@ in
    };
    users.groups.peertube.gid = config.ids.gids.peertube;
-    secrets.keys = [{
+    secrets.keys."websites/syden/peertube" = {
-      dest = "websites/syden/peertube";
      user = "peertube";
      group = "peertube";
      permissions = "0640";
@@ -67,7 +66,7 @@ in
          plugins: '${dataDir}/storage/plugins/'
          client_overrides: '${dataDir}/storage/client-overrides/'
        '';
-    }];
+    };
    services.filesWatcher.syden_peertube = {
      restart = true;
diff --git a/modules/private/websites/tools/cloud/default.nix b/modules/private/websites/tools/cloud/default.nix
index 471858a..fc0aae6 100644
--- a/modules/private/websites/tools/cloud/default.nix
+++ b/modules/private/websites/tools/cloud/default.nix
@@ -73,8 +73,7 @@ in {
      ];
    };
-    secrets.keys = [{
+    secrets.keys."webapps/tools-nextcloud" = {
-      dest = "webapps/tools-nextcloud";
      user = "wwwrun";
      group = "wwwrun";
      permissions = "0600";
@@ -133,7 +132,7 @@ in {
          'has_rebuilt_cache' => true,
        );
      '';
-    }];
+    };
    users.users.root.packages = let
      occ = pkgs.writeScriptBin "nextcloud-occ" ''
        #! ${pkgs.stdenv.shell}
diff --git a/modules/private/websites/tools/commento/default.nix b/modules/private/websites/tools/commento/default.nix
index d0e7d24..c36255b 100644
--- a/modules/private/websites/tools/commento/default.nix
+++ b/modules/private/websites/tools/commento/default.nix
@@ -12,10 +12,9 @@ in
    enable = lib.mkEnableOption "Enable commento website";
  };
  config = lib.mkIf cfg.enable {
-    secrets.keys = [
+    secrets.keys = {
-      {
+      "commento/env" = {
-        dest = "commento/env";
+        permissions = "0400";
-        permission = "0400";
        text = ''
          COMMENTO_ORIGIN=https://commento.immae.eu/
          COMMENTO_PORT=${port}
@@ -29,8 +28,8 @@ in
          COMMENTO_SMTP_PASSWORD=${env.smtp.password}
          COMMENTO_SMTP_FROM_ADDRESS=${env.smtp.email}
        '';
-      }
+      };
-    ];
+    };
    services.websites.env.tools.vhostConfs.commento = {
      certName = "eldiron";
diff --git a/modules/private/websites/tools/dav/davical.nix b/modules/private/websites/tools/dav/davical.nix
index eeac1b5..9e4056a 100644
--- a/modules/private/websites/tools/dav/davical.nix
+++ b/modules/private/websites/tools/dav/davical.nix
@@ -6,8 +6,7 @@ rec {
      install -m 0755 -o ${apache.user} -g ${apache.group} -d /var/lib/php/sessions/davical
      '';
  };
-  keys = [{
+  keys."webapps/dav-davical" = {
-    dest = "webapps/dav-davical";
    user = apache.user;
    group = apache.group;
    permissions = "0400";
@@ -64,7 +63,7 @@ rec {
      $c->do_not_sync_from_ldap = array('admin' => true);
      include('drivers_ldap.php');
    '';
-  }];
+  };
  webapp = davical.override { davical_config = config.secrets.fullPaths."webapps/dav-davical"; };
  webRoot = "${webapp}/htdocs";
  apache = rec {
diff --git a/modules/private/websites/tools/diaspora/default.nix b/modules/private/websites/tools/diaspora/default.nix
index 663fe88..9119ead 100644
--- a/modules/private/websites/tools/diaspora/default.nix
+++ b/modules/private/websites/tools/diaspora/default.nix
@@ -16,16 +16,14 @@ in {
    };
    users.users.diaspora.extraGroups = [ "keys" ];
-    secrets.keys = [
+    secrets.keys = {
-      {
+      "webapps/diaspora" = {
-        dest = "webapps/diaspora";
        isDir = true;
        user = "diaspora";
        group = "diaspora";
        permissions = "0500";
-      }
+      };
-      {
+      "webapps/diaspora/diaspora.yml" = {
-        dest = "webapps/diaspora/diaspora.yml";
        user = "diaspora";
        group = "diaspora";
        permissions = "0400";
@@ -102,9 +100,8 @@ in {
        development:
          environment:
        '';
-      }
+      };
-      {
+      "webapps/diaspora/database.yml" = {
-        dest = "webapps/diaspora/database.yml";
        user = "diaspora";
        group = "diaspora";
        permissions = "0400";
@@ -136,17 +133,16 @@ in {
          <<: *combined
          database: diaspora_integration2
        '';
-      }
+      };
-      {
+      "webapps/diaspora/secret_token.rb" = {
-        dest = "webapps/diaspora/secret_token.rb";
        user = "diaspora";
        group = "diaspora";
        permissions = "0400";
        text = ''
          Diaspora::Application.config.secret_key_base = '${env.secret_token}'
        '';
-      }
+      };
-    ];
+    };
    services.diaspora = {
      enable = true;
diff --git a/modules/private/websites/tools/ether/default.nix b/modules/private/websites/tools/ether/default.nix
index 64e411d..d5c65a9 100644
--- a/modules/private/websites/tools/ether/default.nix
+++ b/modules/private/websites/tools/ether/default.nix
@@ -15,19 +15,16 @@ in {
    services.duplyBackup.profiles.etherpad-lite = {
      rootDir = "/var/lib/private/etherpad-lite";
    };
-    secrets.keys = [
+    secrets.keys = {
-      {
+      "webapps/tools-etherpad-apikey" = {
-        dest = "webapps/tools-etherpad-apikey";
        permissions = "0400";
        text = env.api_key;
-      }
+      };
-      {
+      "webapps/tools-etherpad-sessionkey" = {
-        dest = "webapps/tools-etherpad-sessionkey";
        permissions = "0400";
        text = env.session_key;
-      }
+      };
-      {
+      "webapps/tools-etherpad" = {
-        dest = "webapps/tools-etherpad";
        permissions = "0400";
        text = ''
          {
@@ -152,8 +149,8 @@ in {
            "logconfig" : { "appenders": [ { "type": "console" } ] }
          }
        '';
-      }
+      };
-    ];
+    };
    services.etherpad-lite = {
      enable = true;
      package = pkgs.webapps.etherpad-lite.withModules (p: [
diff --git a/modules/private/websites/tools/git/mantisbt.nix b/modules/private/websites/tools/git/mantisbt.nix
index e6a8da7..033a651 100644
--- a/modules/private/websites/tools/git/mantisbt.nix
+++ b/modules/private/websites/tools/git/mantisbt.nix
@@ -6,8 +6,7 @@ rec {
      install -m 0755 -o ${apache.user} -g ${apache.group} -d /var/lib/php/sessions/mantisbt
    '';
  };
-  keys = [{
+  keys."webapps/tools-mantisbt" = {
-    dest = "webapps/tools-mantisbt";
    user = apache.user;
    group = apache.group;
    permissions = "0400";
@@ -45,7 +44,7 @@ rec {
      $g_ldap_realname_field = 'cn';
      $g_ldap_organization = '${env.ldap.filter}';
    '';
-  }];
+  };
  webRoot = (mantisbt_2.override { mantis_config = config.secrets.fullPaths."webapps/tools-mantisbt"; }).withPlugins (p: [p.slack p.source-integration]);
  apache = rec {
    user = "wwwrun";
diff --git a/modules/private/websites/tools/mail/roundcubemail.nix b/modules/private/websites/tools/mail/roundcubemail.nix
index 7d8e733..92de28e 100644
--- a/modules/private/websites/tools/mail/roundcubemail.nix
+++ b/modules/private/websites/tools/mail/roundcubemail.nix
@@ -9,8 +9,7 @@ rec {
      install -m 0750 -o ${apache.user} -g ${apache.group} -d ${varDir}/phpSessions
    '';
  };
-  keys = [{
+  keys."webapps/tools-roundcube" = {
-    dest = "webapps/tools-roundcube";
    user = apache.user;
    group = apache.group;
    permissions = "0400";
@@ -74,7 +73,7 @@ rec {
        $config['temp_dir'] = '${varDir}/cache';
        $config['mime_types'] = '${apacheHttpd}/conf/mime.types';
    '';
-  }];
+  };
  webRoot = (roundcubemail.override { roundcube_config = config.secrets.fullPaths."webapps/tools-roundcube"; }).withPlugins (p: [ p.automatic_addressbook p.carddav p.contextmenu p.contextmenu_folder p.html5_notifier p.ident_switch p.message_highlight p.thunderbird_labels ]);
  apache = rec {
    user = "wwwrun";
diff --git a/modules/private/websites/tools/mastodon/default.nix b/modules/private/websites/tools/mastodon/default.nix
index cea8710..87e8d72 100644
--- a/modules/private/websites/tools/mastodon/default.nix
+++ b/modules/private/websites/tools/mastodon/default.nix
@@ -13,8 +13,7 @@ in {
    services.duplyBackup.profiles.mastodon = {
      rootDir = mcfg.dataDir;
    };
-    secrets.keys = [{
+    secrets.keys."webapps/tools-mastodon" = {
-      dest = "webapps/tools-mastodon";
      user = "mastodon";
      group = "mastodon";
      permissions = "0400";
@@ -59,7 +58,7 @@ in {
        LDAP_UID="uid"
        LDAP_SEARCH_FILTER="${env.ldap.filter}"
      '';
-    }];
+    };
    services.mastodon = {
      enable = true;
      configFile = config.secrets.fullPaths."webapps/tools-mastodon";
diff --git a/modules/private/websites/tools/mgoblin/default.nix b/modules/private/websites/tools/mgoblin/default.nix
index 6d6a5a4..f6cba4a 100644
--- a/modules/private/websites/tools/mgoblin/default.nix
+++ b/modules/private/websites/tools/mgoblin/default.nix
@@ -12,8 +12,7 @@ in {
    services.duplyBackup.profiles.mgoblin = {
      rootDir = mcfg.dataDir;
    };
-    secrets.keys = [{
+    secrets.keys."webapps/tools-mediagoblin" = {
-      dest = "webapps/tools-mediagoblin";
      user = "mediagoblin";
      group = "mediagoblin";
      permissions = "0400";
@@ -77,7 +76,7 @@ in {
          [[mediagoblin.media_types.image]]
          [[mediagoblin.media_types.video]]
        '';
-    }];
+    };
    users.users.mediagoblin.extraGroups = [ "keys" ];
diff --git a/modules/private/websites/tools/peertube/default.nix b/modules/private/websites/tools/peertube/default.nix
index 7dcc998..daeeb1f 100644
--- a/modules/private/websites/tools/peertube/default.nix
+++ b/modules/private/websites/tools/peertube/default.nix
@@ -18,8 +18,7 @@ in {
    };
    users.users.peertube.extraGroups = [ "keys" ];
-    secrets.keys = [{
+    secrets.keys."webapps/tools-peertube" = {
-      dest = "webapps/tools-peertube";
      user = "peertube";
      group = "peertube";
      permissions = "0640";
@@ -62,7 +61,7 @@ in {
          plugins: '${pcfg.dataDir}/storage/plugins/'
          client_overrides: '${pcfg.dataDir}/storage/client-overrides/'
        '';
-    }];
+    };
    services.websites.env.tools.modules = [
      "headers" "proxy" "proxy_http" "proxy_wstunnel"
diff --git a/modules/private/websites/tools/performance/default.nix b/modules/private/websites/tools/performance/default.nix
index 5afd639..5715ff0 100644
--- a/modules/private/websites/tools/performance/default.nix
+++ b/modules/private/websites/tools/performance/default.nix
@@ -11,9 +11,8 @@ in
  };
  config = lib.mkIf cfg.enable {
-    secrets.keys = [
+    secrets.keys = {
-      {
+      status_engine_ui = {
-        dest = "status_engine_ui";
        permissions = "0400";
        user = "wwwrun";
        group = "wwwrun";
@@ -44,8 +43,8 @@ in
          display_perfdata: 1
          perfdata_backend: mysql
        '';
-      }
+      };
-    ];
+    };
    services.websites.env.tools.modules = [ "proxy_fcgi" ];
diff --git a/modules/private/websites/tools/stats/default.nix b/modules/private/websites/tools/stats/default.nix
index 5f184bc..71e31a3 100644
--- a/modules/private/websites/tools/stats/default.nix
+++ b/modules/private/websites/tools/stats/default.nix
@@ -6,9 +6,8 @@ in
 {
  options.myServices.websites.tools.stats.enable = lib.mkEnableOption "Enable stats site";
  config = lib.mkIf cfg.enable {
-    secrets.keys = [
+    secrets.keys = {
-      {
+      "uami/env" = {
-        dest = "umami/env";
        permission = "0400";
        text = ''
          PORT=${toString myCfg.listenPort}
@@ -16,8 +15,8 @@ in
          DATABASE_URL=postgresql://${myCfg.postgresql.user}:${myCfg.postgresql.password}@localhost:${myCfg.postgresql.port}/${myCfg.postgresql.database}?sslmode=disable&host=${myCfg.postgresql.socket}
          HASH_SALT=${myCfg.hashSalt}
        '';
-      }
+      };
-    ];
+    };
    services.websites.env.tools.vhostConfs.stats = {
      certName = "eldiron";
diff --git a/modules/private/websites/tools/tools/csp_reports.nix b/modules/private/websites/tools/tools/csp_reports.nix
index 4660251..9b3f0cf 100644
--- a/modules/private/websites/tools/tools/csp_reports.nix
+++ b/modules/private/websites/tools/tools/csp_reports.nix
@@ -1,12 +1,11 @@
 { env }:
 rec {
-  keys = [{
+  keys."webapps/tools-csp-reports.conf" = {
-    dest = "webapps/tools-csp-reports.conf";
    user = "wwwrun";
    group = "wwwrun";
    permissions = "0400";
    text = with env.postgresql; ''
      env[CSP_REPORT_URI] = "host=${socket} dbname=${database} user=${user} password=${password}"
    '';
-  }];
+  };
 }
diff --git a/modules/private/websites/tools/tools/default.nix b/modules/private/websites/tools/tools/default.nix
index ada6253..1f499fb 100644
--- a/modules/private/websites/tools/tools/default.nix
+++ b/modules/private/websites/tools/tools/default.nix
@@ -83,14 +83,14 @@ in {
  config = lib.mkIf cfg.enable {
    secrets.keys =
      kanboard.keys
-      ++ ldap.keys
+      // ldap.keys
-      ++ shaarli.keys
+      // shaarli.keys
-      ++ ttrss.keys
+      // ttrss.keys
-      ++ wallabag.keys
+      // wallabag.keys
-      ++ yourls.keys
+      // yourls.keys
-      ++ dmarc-reports.keys
+      // dmarc-reports.keys
-      ++ csp-reports.keys
+      // csp-reports.keys
-      ++ webhooks.keys;
+      // webhooks.keys;
    services.duplyBackup.profiles = {
      dokuwiki = dokuwiki.backups;
diff --git a/modules/private/websites/tools/tools/dmarc_reports.nix b/modules/private/websites/tools/tools/dmarc_reports.nix
index 5fdf0b6..89da246 100644
--- a/modules/private/websites/tools/tools/dmarc_reports.nix
+++ b/modules/private/websites/tools/tools/dmarc_reports.nix
@@ -1,7 +1,6 @@
 { env, config }:
 rec {
-  keys = [{
+  keys."webapps/tools-dmarc-reports.php" = {
-    dest = "webapps/tools-dmarc-reports.php";
    user = "wwwrun";
    group = "wwwrun";
    permissions = "0400";
@@ -15,7 +14,7 @@ rec {
      $anonymous_key = "${env.anonymous_key}";
      ?>
    '';
-  }];
+  };
  webRoot = ./dmarc_reports;
  apache = rec {
    user = "wwwrun";
diff --git a/modules/private/websites/tools/tools/kanboard.nix b/modules/private/websites/tools/tools/kanboard.nix
index 1a70499..b2e7b65 100644
--- a/modules/private/websites/tools/tools/kanboard.nix
+++ b/modules/private/websites/tools/tools/kanboard.nix
@@ -13,8 +13,7 @@ rec {
      install -TDm644 ${webRoot}/dataold/web.config ${varDir}/data/web.config
    '';
  };
-  keys = [{
+  keys."webapps/tools-kanboard" = {
-    dest = "webapps/tools-kanboard";
    user = apache.user;
    group = apache.group;
    permissions = "0400";
@@ -41,7 +40,7 @@ rec {
      define('LDAP_GROUP_ADMIN_DN', '${env.ldap.admin_dn}');
      ?>
      '';
-  }];
+  };
  webRoot = kanboard { kanboard_config = config.secrets.fullPaths."webapps/tools-kanboard"; };
  apache = rec {
    user = "wwwrun";
diff --git a/modules/private/websites/tools/tools/ldap.nix b/modules/private/websites/tools/tools/ldap.nix
index cb90edc..14920f4 100644
--- a/modules/private/websites/tools/tools/ldap.nix
+++ b/modules/private/websites/tools/tools/ldap.nix
@@ -6,8 +6,7 @@ rec {
      install -m 0755 -o ${apache.user} -g ${apache.group} -d /var/lib/php/sessions/phpldapadmin
      '';
  };
-  keys = [{
+  keys."webapps/tools-ldap" = {
-    dest = "webapps/tools-ldap";
    user = apache.user;
    group = apache.group;
    permissions = "0400";
@@ -31,7 +30,7 @@ rec {
      $servers->setValue('login','attr','uid');
      $servers->setValue('login','fallback_dn',true);
      '';
-  }];
+  };
  webRoot = phpldapadmin.override { config = config.secrets.fullPaths."webapps/tools-ldap"; };
  apache = rec {
    user = "wwwrun";
diff --git a/modules/private/websites/tools/tools/shaarli.nix b/modules/private/websites/tools/tools/shaarli.nix
index 80c6a89..b7126cc 100644
--- a/modules/private/websites/tools/tools/shaarli.nix
+++ b/modules/private/websites/tools/tools/shaarli.nix
@@ -38,8 +38,7 @@ in rec {
      </Directory>
      '';
  };
-  keys = [{
+  keys."webapps/tools-shaarli" = {
-    dest = "webapps/tools-shaarli";
    user = apache.user;
    group = apache.group;
    permissions = "0400";
@@ -50,7 +49,7 @@ in rec {
      SetEnv SHAARLI_LDAP_BASE     "${env.ldap.base}"
      SetEnv SHAARLI_LDAP_FILTER   "${env.ldap.filter}"
      '';
-  }];
+  };
  phpFpm = rec {
    serviceDeps = [ "openldap.service" ];
    basedir = builtins.concatStringsSep ":" [ webRoot varDir ];
diff --git a/modules/private/websites/tools/tools/ttrss.nix b/modules/private/websites/tools/tools/ttrss.nix
index eb1d415..f6abae9 100644
--- a/modules/private/websites/tools/tools/ttrss.nix
+++ b/modules/private/websites/tools/tools/ttrss.nix
@@ -19,8 +19,7 @@ rec {
      install -m 0750 -o ${apache.user} -g ${apache.group} -d ${varDir}/phpSessions
    '';
  };
-  keys = [{
+  keys."webapps/tools-ttrss" = {
-    dest = "webapps/tools-ttrss";
    user = apache.user;
    group = apache.group;
    permissions = "0400";
@@ -87,7 +86,7 @@ rec {
        define('LDAP_AUTH_LOG_ATTEMPTS', FALSE);
        define('LDAP_AUTH_DEBUG', FALSE);
      '';
-  }];
+  };
  webRoot = (ttrss.override { ttrss_config = config.secrets.fullPaths."webapps/tools-ttrss"; }).withPlugins (p: [
    p.auth_ldap p.ff_instagram p.tumblr_gdpr_ua
    (p.af_feedmod.override { patched = true; })
diff --git a/modules/private/websites/tools/tools/wallabag.nix b/modules/private/websites/tools/tools/wallabag.nix
index 1a604c7..b6ad151 100644
--- a/modules/private/websites/tools/tools/wallabag.nix
+++ b/modules/private/websites/tools/tools/wallabag.nix
@@ -5,8 +5,7 @@ rec {
    remotes = [ "eriomem" "ovh" ];
  };
  varDir = "/var/lib/wallabag";
-  keys = [{
+  keys."webapps/tools-wallabag" = {
-    dest = "webapps/tools-wallabag";
    user = apache.user;
    group = apache.group;
    permissions = "0400";
@@ -68,7 +67,7 @@ rec {
              class:     Swift_SendmailTransport
              arguments: ['/run/wrappers/bin/sendmail -bs']
      '';
-  }];
+  };
  webappDir = wallabag.override { ldap = true; wallabag_config = config.secrets.fullPaths."webapps/tools-wallabag"; };
  activationScript = ''
    install -m 0755 -o ${apache.user} -g ${apache.group} -d ${varDir} \
diff --git a/modules/private/websites/tools/tools/webhooks.nix b/modules/private/websites/tools/tools/webhooks.nix
index 8ffb81b..785e22b 100644
--- a/modules/private/websites/tools/tools/webhooks.nix
+++ b/modules/private/websites/tools/tools/webhooks.nix
@@ -1,16 +1,17 @@
 { lib, env }:
 {
-  keys = lib.attrsets.mapAttrsToList (k: v: {
+  keys = lib.attrsets.mapAttrs' (k: v:
-    dest = "webapps/webhooks/${k}.php";
+    lib.nameValuePair "webapps/webhooks/${k}.php" {
    user = "wwwrun";
    group = "wwwrun";
    permissions = "0400";
    text = v;
-  }) env ++ [{
+  }) env // {
-    dest = "webapps/webhooks";
+    "webapps/webhooks" = {
-    isDir = true;
+      isDir = true;
-    user = "wwwrun";
+      user = "wwwrun";
-    group = "wwwrun";
+      group = "wwwrun";
-    permissions = "0500";
+      permissions = "0500";
-  }];
+    };
+  };
 }
diff --git a/modules/private/websites/tools/tools/yourls.nix b/modules/private/websites/tools/tools/yourls.nix
index 0f977f2..01ef548 100644
--- a/modules/private/websites/tools/tools/yourls.nix
+++ b/modules/private/websites/tools/tools/yourls.nix
@@ -6,8 +6,7 @@ rec {
      install -m 0755 -o ${apache.user} -g ${apache.group} -d /var/lib/php/sessions/yourls
    '';
  };
-  keys = [{
+  keys."webapps/tools-yourls" = {
-    dest = "webapps/tools-yourls";
    user = apache.user;
    group = apache.group;
    permissions = "0400";
@@ -39,7 +38,7 @@ rec {
      define( 'LDAPAUTH_USERCACHE_TYPE', 0);
    '';
-  }];
+  };
  webRoot = (yourls.override { yourls_config = config.secrets.fullPaths."webapps/tools-yourls"; }).withPlugins (p: [p.ldap]);
  apache = rec {
    user = "wwwrun";
diff --git a/modules/zrepl.nix b/modules/zrepl.nix
index cb74082..5bcc17b 100644
--- a/modules/zrepl.nix
+++ b/modules/zrepl.nix
@@ -16,15 +16,14 @@ in
  };
  config = lib.mkIf cfg.enable {
-    secrets.keys = [
+    secrets.keys = {
-      {
+      "zrepl/zrepl.yml" = {
-        dest = "zrepl/zrepl.yml";
        permissions = "0400";
        text = cfg.config;
        user = config.systemd.services.zrepl.serviceConfig.User or "root";
        group = config.systemd.services.zrepl.serviceConfig.Group or "root";
-      }
+      };
-    ];
+    };
    services.filesWatcher.zrepl = {
      restart = true;
      paths = [ config.secrets.fullPaths."zrepl/zrepl.yml" ];