# ensure SSH waits for agenix to decrypt secrets
  systemd.services.sshd.after = [ "agenix.service" ];
  systemd.services.sshd.wants = [ "agenix.service" ];