{
  imports = [
    ./approle.nix
    ./ssh-host.nix
    ./loki-mtls.nix
    ./prometheus-mtls.nix
    ./unix-users.nix
  ];
  khscodes.infrastructure.vault-server-approle.path = "\${ vault_auth_backend.approle.path }";
  khscodes.infrastructure.provisioning.post.modules = [
    (
      { config, ... }:
      {
        khscodes.vault.mount.opentofu = {
          path = "opentofu";
          type = "kv";
          options = {
            version = "2";
          };
          description = "Secrets used during provisioning";
        };
        resource.vault_kv_secret_backend_v2.opentofu = {
          mount = config.khscodes.vault.output.mount.opentofu.path;
          max_versions = 5;
          cas_required = false;
        };
      }
    )
  ];
}
