diff --git a/flake.lock b/flake.lock
index 6ba24c5..8eaa5e6 100644
--- a/flake.lock
+++ b/flake.lock
@@ -16,6 +16,31 @@
         "type": "github"
       }
     },
+    "agenix": {
+      "inputs": {
+        "darwin": "darwin",
+        "home-manager": [
+          "home-manager"
+        ],
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1770165109,
+        "narHash": "sha256-9VnK6Oqai65puVJ4WYtCTvlJeXxMzAp/69HhQuTdl/I=",
+        "owner": "ryantm",
+        "repo": "agenix",
+        "rev": "b027ee29d959fda4b60b57566d64c98a202e0feb",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ryantm",
+        "repo": "agenix",
+        "type": "github"
+      }
+    },
     "blobs": {
       "flake": false,
       "locked": {
@@ -130,6 +155,28 @@
         "type": "github"
       }
     },
+    "darwin": {
+      "inputs": {
+        "nixpkgs": [
+          "agenix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1744478979,
+        "narHash": "sha256-dyN+teG9G82G+m+PX/aSAagkC+vUv0SgUw3XkPhQodQ=",
+        "owner": "lnl7",
+        "repo": "nix-darwin",
+        "rev": "43975d782b418ebf4969e9ccba82466728c2851b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "lnl7",
+        "ref": "master",
+        "repo": "nix-darwin",
+        "type": "github"
+      }
+    },
     "demoji": {
       "inputs": {
         "advisory-db": "advisory-db",
@@ -265,7 +312,7 @@
     },
     "flake-utils": {
       "inputs": {
-        "systems": "systems"
+        "systems": "systems_2"
       },
       "locked": {
         "lastModified": 1681202837,
@@ -283,7 +330,7 @@
     },
     "flake-utils_2": {
       "inputs": {
-        "systems": "systems_2"
+        "systems": "systems_3"
       },
       "locked": {
         "lastModified": 1681202837,
@@ -316,7 +363,7 @@
     },
     "flake-utils_4": {
       "inputs": {
-        "systems": "systems_3"
+        "systems": "systems_4"
       },
       "locked": {
         "lastModified": 1681202837,
@@ -334,7 +381,7 @@
     },
     "flake-utils_5": {
       "inputs": {
-        "systems": "systems_4"
+        "systems": "systems_5"
       },
       "locked": {
         "lastModified": 1681202837,
@@ -352,7 +399,7 @@
     },
     "flake-utils_6": {
       "inputs": {
-        "systems": "systems_5"
+        "systems": "systems_6"
       },
       "locked": {
         "lastModified": 1681202837,
@@ -370,7 +417,7 @@
     },
     "flake-utils_7": {
       "inputs": {
-        "systems": "systems_6"
+        "systems": "systems_7"
       },
       "locked": {
         "lastModified": 1710146030,
@@ -744,6 +791,7 @@
     },
     "root": {
       "inputs": {
+        "agenix": "agenix",
         "catboy-spinner": "catboy-spinner",
         "contador-da-viagem": "contador-da-viagem",
         "demoji": "demoji",
@@ -925,6 +973,21 @@
         "type": "github"
       }
     },
+    "systems_7": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
     "tlauncher": {
       "inputs": {
         "flake-utils": "flake-utils_5",
diff --git a/flake.nix b/flake.nix
index f3d6e23..97c7a6e 100644
--- a/flake.nix
+++ b/flake.nix
@@ -22,6 +22,12 @@
     plymouth-themes.url = "github:adi1090x/plymouth-themes";
     plymouth-themes.flake = false;
 
+    agenix = {
+      url = "github:ryantm/agenix";
+      inputs.nixpkgs.follows = "nixpkgs";
+      inputs.home-manager.follows = "home-manager";
+    };
+
     sops-nix = {
       url = "github:Mic92/sops-nix";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -105,10 +111,12 @@
       common_modules = [
         { nixpkgs.pkgs = pkgs; }
         ./system/configuration.nix
+        ./system/secrets.nix
         ./system/sops.nix
         ./system/greetd.nix
         { login-manager.greetd.enable = desktop == "sway"; }
 
+        inputs.agenix.nixosModules.default
         inputs.sops-nix.nixosModules.default
         inputs.home-manager.nixosModules.home-manager
         inputs.disko.nixosModules.disko
diff --git a/hosts/monolith/default.nix b/hosts/monolith/default.nix
index 0ce3b79..bf0e98e 100644
--- a/hosts/monolith/default.nix
+++ b/hosts/monolith/default.nix
@@ -43,8 +43,6 @@ in
     package = pkgs.unstable.opentabletdriver;
   };
 
-  sops.defaultSopsFile = lib.mkForce ../../secrets/monolith/default.yaml;
-
   my.gaming.enable = true;
   my.nix-ld.enable = true;
 
diff --git a/hosts/monolith/factorio-server.nix b/hosts/monolith/factorio-server.nix
index 0db1e3a..debbc1e 100644
--- a/hosts/monolith/factorio-server.nix
+++ b/hosts/monolith/factorio-server.nix
@@ -12,7 +12,7 @@
     lan = true;
     openFirewall = true;
     admins = [ "lelgenio" ];
-    extraSettingsFile = config.sops.secrets."factorio/server-config.json".path;
+    extraSettingsFile = config.age.secrets.factorio-settings.path;
   };
 
   systemd.services.factorio = {
@@ -43,7 +43,8 @@
     wantedBy = [ "timers.target" ];
   };
 
-  sops.secrets."factorio/server-config.json" = {
+  age.secrets.factorio-settings = {
+    file = ../../secrets/factorio-settings.age;
     mode = "777";
   };
 }
diff --git a/hosts/phantom/default.nix b/hosts/phantom/default.nix
index e32fa95..1b0d3cb 100644
--- a/hosts/phantom/default.nix
+++ b/hosts/phantom/default.nix
@@ -8,6 +8,7 @@
 {
   imports = [
     inputs.vpsadminos.nixosConfigurations.container
+    inputs.agenix.nixosModules.default
     inputs.sops-nix.nixosModules.default
 
     ../../system/sops.nix
diff --git a/hosts/phantom/forgejo.nix b/hosts/phantom/forgejo.nix
index c7a224b..dbb63d3 100644
--- a/hosts/phantom/forgejo.nix
+++ b/hosts/phantom/forgejo.nix
@@ -42,10 +42,11 @@ in
         USER = "noreply@git.lelgenio.com";
       };
     };
-    secrets.mailer.PASSWD = config.sops.secrets."forgejo/smtp_password".path;
+    mailerPasswordFile = config.age.secrets.phantom-forgejo-mailer-password.path;
   };
 
-  sops.secrets."forgejo/smtp_password" = {
+  age.secrets.phantom-forgejo-mailer-password = {
+    file = ../../secrets/phantom-forgejo-mailer-password.age;
     mode = "400";
     owner = "forgejo";
   };
diff --git a/hosts/phantom/invidious.nix b/hosts/phantom/invidious.nix
index d4486d7..60c1dca 100644
--- a/hosts/phantom/invidious.nix
+++ b/hosts/phantom/invidious.nix
@@ -23,7 +23,7 @@
     #     "visitor_data": "...",
     #     "po_token": "..."
     # }
-    extraSettingsFile = config.sops.secrets."invidious/settings.json".path;
+    extraSettingsFile = config.age.secrets.phantom-invidious-settings.path;
     settings = {
       force_resolve = "ipv6";
       db = {
@@ -33,7 +33,8 @@
     };
   };
 
-  sops.secrets."invidious/settings.json" = {
+  age.secrets.phantom-invidious-settings = {
+    file = ../../secrets/phantom-invidious-settings.age;
     mode = "666";
   };
 }
diff --git a/hosts/phantom/mastodon.nix b/hosts/phantom/mastodon.nix
index e21e874..d0dd5d3 100644
--- a/hosts/phantom/mastodon.nix
+++ b/hosts/phantom/mastodon.nix
@@ -14,14 +14,15 @@
       host = "lelgenio.com";
       fromAddress = "noreply@social.lelgenio.com";
       user = "noreply@social.lelgenio.com";
-      passwordFile = config.sops.secrets."mastodon/smtp-password".path;
+      passwordFile = config.age.secrets.phantom-mastodon-mailer-password.path;
     };
     streamingProcesses = 2;
     extraConfig.SINGLE_USER_MODE = "true";
     mediaAutoRemove.olderThanDays = 5;
   };
 
-  sops.secrets."mastodon/smtp-password" = {
+  age.secrets.phantom-mastodon-mailer-password = {
+    file = ../../secrets/phantom-mastodon-mailer-password.age;
     mode = "400";
     owner = "mastodon";
   };
diff --git a/hosts/phantom/nextcloud.nix b/hosts/phantom/nextcloud.nix
index 6b8a020..d95e598 100644
--- a/hosts/phantom/nextcloud.nix
+++ b/hosts/phantom/nextcloud.nix
@@ -11,7 +11,7 @@
     https = true;
     config = {
       dbtype = "sqlite"; # TODO: move to single postgres db
-      adminpassFile = config.sops.secrets."nextcloud/default-password".path;
+      adminpassFile = config.age.secrets.phantom-nextcloud.path;
     };
   };
 
@@ -20,9 +20,12 @@
     enableACME = true;
   };
 
-  sops.secrets."nextcloud/default-password" = {
-    mode = "400";
-    owner = "nextcloud";
-    group = "nextcloud";
+  age = {
+    secrets.phantom-nextcloud = {
+      file = ../../secrets/phantom-nextcloud.age;
+      mode = "400";
+      owner = "nextcloud";
+      group = "nextcloud";
+    };
   };
 }
diff --git a/hosts/phantom/writefreely.nix b/hosts/phantom/writefreely.nix
index 2358981..5608c0f 100644
--- a/hosts/phantom/writefreely.nix
+++ b/hosts/phantom/writefreely.nix
@@ -12,16 +12,19 @@
     nginx.forceSSL = true;
     host = "blog.lelgenio.com";
     admin.name = "lelgenio";
-    admin.initialPasswordFile = config.sops.secrets."writefreely/password".path;
+    admin.initialPasswordFile = config.age.secrets.phantom-writefreely.path;
     settings.app = {
       site_name = "Leo's blog";
       single_user = true;
     };
   };
 
-  sops.secrets."writefreely/password" = {
-    mode = "400";
-    owner = "writefreely";
-    group = "writefreely";
+  age = {
+    secrets.phantom-writefreely = {
+      file = ../../secrets/phantom-writefreely.age;
+      mode = "400";
+      owner = "writefreely";
+      group = "writefreely";
+    };
   };
 }
diff --git a/secrets/factorio-settings.age b/secrets/factorio-settings.age
new file mode 100644
index 0000000..77eb8bd
Binary files /dev/null and b/secrets/factorio-settings.age differ
diff --git a/secrets/gitlab-runner-thoreb-telemetria-registrationConfigFile.age b/secrets/gitlab-runner-thoreb-telemetria-registrationConfigFile.age
new file mode 100644
index 0000000..1d7d3ff
--- /dev/null
+++ b/secrets/gitlab-runner-thoreb-telemetria-registrationConfigFile.age
@@ -0,0 +1,16 @@
+age-encryption.org/v1
+-> ssh-rsa BwwxHg
+KuJIQzvERsM1zAF4iikbaIMsi4e/vnyx1yq6h9Mzxf6FnXyFRcUgLPVe05krQhJX
+0wjv18bI0jxRb8742Ww9i2nU5Tlrok9ol458iye5CPl63fAlVih4/Rkl3IkUIiIz
+q/VayGVaIHmpRD2xiEa4L+NXS9N69vVXoubX0oZrB0nPdYJ83gFU9u+CBqqG2EWr
+PBjyIvT5i5MDBnPZGOudadIoyeWGfjXEPsQWhQhL9ssi5QOzLXBnTDlxT53bNvHX
+2yOFprLDZ+ZONedkxy8OXZpPDYNcgPAIHiqx1E87ftqPIucdeU49AqlPh46wrPC3
+79E2hgSoPvn4poTlJtAD0tIADRGkcEV6wLCylN2lTOUJenUfhLNQ7ok4ITx8MOv3
+IkbWiD9yTMExVBlhc+us+XfBHM8mlWs/zu+18YTy21RM03gzY6lHVZCQPxay2Rof
+A505SeZ4Tyhoy0+oLaYv9b+7DJdlhUo/XMaKSibtgJ/2MCtRqmV5ZsnuUIWn1Qsc
+
+-> Vg-grease `tLg-(2z
+4EPuRnZmXpoB32r/0GCtskU3HU3h5ic
+--- QmKr+zAXnMpWBBBqNm2u954fOu2Zt8Y/kPPdq4UHgZc
+��{�u|��u�Ӏ]OmX�P3����4_��
�_
+q4���6m�m�<�pLH+d.h���C<RD��q�O�}��3�Z�KJ�D��j]��ү�
����CRO˥F;>�
\ No newline at end of file
diff --git a/secrets/lelgenio-cachix.age b/secrets/lelgenio-cachix.age
new file mode 100644
index 0000000..af5a250
Binary files /dev/null and b/secrets/lelgenio-cachix.age differ
diff --git a/secrets/monolith-forgejo-runner-token.age b/secrets/monolith-forgejo-runner-token.age
new file mode 100644
index 0000000..fff63ca
Binary files /dev/null and b/secrets/monolith-forgejo-runner-token.age differ
diff --git a/secrets/monolith-gitlab-runner-thoreb-itinerario-registrationConfigFile.age b/secrets/monolith-gitlab-runner-thoreb-itinerario-registrationConfigFile.age
new file mode 100644
index 0000000..60c5c70
--- /dev/null
+++ b/secrets/monolith-gitlab-runner-thoreb-itinerario-registrationConfigFile.age
@@ -0,0 +1,13 @@
+age-encryption.org/v1
+-> ssh-rsa BwwxHg
+YvABDqm9pSLhyLaKLDStuDisPJnaDpHnpTdTU4/xWgD3F4g2WkMymilhabqM+R5S
+hqcSVDxYE2mpPDPIDIMPRlZyw5EBKS6zQYFr7u3fdSMzzhL6pBLUvFtfq40Y3o6C
+LkkkYyWnJisWuTYeBY95H+fbDhqOylbjHP1fhRVwXO85pa4CcRMAWU2pKOIZRb3T
+IuQyE3LOT/vts56q0mgdItJK0gX0NJzXxi+8YdXb2VU5ny6IOBzDL4jUHhi4nfpS
+AmzEZE3ezq4Nxg+txMDQ6ZO+JUhqjCS4XDf5b2Lq6fDenVhFaNYf4HK/fMZHKhKE
+Ac+K5U3CKB7B2Ur+sEdB7AYWOc346bvxZhP16nwCI0ocaquo6WzEa6XA7zfRVC86
+wlTIUVdYKW3e/4AIHFnSXhFNss52kkhOjxcdQpdBb5RgSc/gWel7XFJ3bV17bCmV
+ccCYejBvW+Arpgr9Tl3UfyEbRbGTe7Jbxydsrx5h7gcXOuBYE3x8RGhegiL28wVl
+
+--- E11l59lvUhPNzXAYTgVUIIUCgJsEsSDMdnLV6r+qSiA
+�ˋ-&I:ڹSa�_��zt���J!H��'�C`'u�@s��'�:�����ζ~�[0���n�Y-u�F�e܋���`x�7�����D����0�/×%V��ޑ�U�
\ No newline at end of file
diff --git a/secrets/monolith-nix-serve-privkey.age b/secrets/monolith-nix-serve-privkey.age
new file mode 100644
index 0000000..843b433
Binary files /dev/null and b/secrets/monolith-nix-serve-privkey.age differ
diff --git a/secrets/monolith/default.yaml b/secrets/monolith/default.yaml
index afa1c8f..6b3c1ff 100644
--- a/secrets/monolith/default.yaml
+++ b/secrets/monolith/default.yaml
@@ -13,10 +13,6 @@ nebula-wopus-vpn:
     monolith-key: ENC[AES256_GCM,data:Y8KVQk66dewyeRIF+6HJeufD9EYO55m73LxrtZi4KQU0RbUpsV0eiRMX62rYtw6+uP87f5Tx6kC3fX4+mqNb2ZgDtVvm3/Qnz5Ly112c/h33krNqRpv6pEHRkrS9j01tLkJnxwiyIvq3b03GTAIoCKWgqaaagCXYHArgzRrDIw==,iv:lp3zuD8XWaiJvyxzXHrgpF4qbrCv/uf9l9qyWXVrkkM=,tag:eSlTCa2TrIuga7UUxoloBQ==,type:str]
 minio:
     root-credentials: ENC[AES256_GCM,data:izDiis6BgAubbe91EUcuwMKrSrYEDQFQbaEGzpdjj3Wlt8Z8gzgvGmYCryAK8GBUMbzQvy0do26xMGMl3LxLWz9bgixixPVFTTg5GhfUJw==,iv:hkrkGz+EpVwkWEMQWBrm2u4Jti7azsDtsTmyouDREug=,tag:mDnOKKBwgKOmsxegKcRhpQ==,type:str]
-nix-serve:
-    private-key: ENC[AES256_GCM,data:xSHNHiLKs5QG92cSR0gNlusRhGjRUcelSvBt/f3+LdLjTtPaYMmiEiUsl43FyaigGkGq4nGDWAgPVJ+bFNpman0F4KwYqoSp5zH07IC9KaXouvudRLMZc8MkpwKKptKebKDlxKfsLt44n3qnV7OPYzSgzA==,iv:yUM/4yCIJqTt04HyXBVe+EMN4NnFkVnVhsUvUlKv2QM=,tag:qAr0UIjWzXH1eEzGCrK5Vg==,type:str]
-factorio:
-    server-config.json: ENC[AES256_GCM,data:qpLNcNjKrlH5IjGsq7ukCPR7G5dfOfN9joM2KZUdKZetZ/mA8ikBSbuBtRxwBQUSB6PcFxDftus704vlOkLcDcc4PT9rnpEiedLng9NkJPZZo2exfozut3N7dhij28c6Jy2uvad1pzAfW78iHI0kJNkDQDD2oW9xoFAZrPDRh5oNLpNn1/iIFoIflyYFctUbcpsDvs+8xHGGM5PQQo0QnZcxfSPY2iT4At1i5WP/Uedonvlw9fNcoOtzP7BhOECuMWUC5W2v2hP2/vcp7M8=,iv:Ln+/4AudJfdJYdkq0xLVF8dyrObzLwhANpTo3WgjUF4=,tag:Rgw4/J016Geiv6FwF5ZaMQ==,type:str]
 sops:
     age:
         - recipient: age1zrgu7w8059xydagm60phnffghvfe9h2ca58cx8qwagqpyfuvs9fqw79c8h
@@ -37,8 +33,8 @@ sops:
             aFVxcDFhaGdYekRWRVFIWnRsZndtZFkKgsvxOFHOcO306Z9FkucA1fDOpZA8N1/h
             jYmIgcKTFgWoSCvux67lK30jFsYp7sm5z6WxxDYsGcoQ/+pxoUX2jQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-02-15T06:33:37Z"
-    mac: ENC[AES256_GCM,data:lYnwpoQuDSRpcPdIoSX3aGssc34UPqj6aZaliXl9XKMu1FMEgKwYXvNGOgs4tV2hBUQvTB4ZhiPT62awEHxzO1CmVdi6eiR9LTP2KetVubvKp8Ps/xoWKl51pG9ubJj+H3rfwAhfbGVZmAb6PKQgY6mnpyutlt/ojCMoKJ4BVwM=,iv:O0MoP+Nb1+nrowX3yfhIY/pjtSbLPV6qHOhDiEfdpzw=,tag:qSA02qKepxJ8p1qpZYN+UQ==,type:str]
+    lastmodified: "2025-11-27T15:58:01Z"
+    mac: ENC[AES256_GCM,data:8JemHyxdcDjkg++kgBAGpvGZAyGnQhcAOzs58D8EqjJzTWWf4HgF3uD8od5EGu5i1f7IzUBNio57H/0DC7fWZk/vIRM/Xn7DREuXClBGmBsc32H+K0tOKg8hMb11PDGqviw0qj0qwl1Gs0+j8C4OY9qLupTDzsECUgRXBtsD4cU=,iv:vOV25BV/C3hK/D4bKb26Xi0PaiSlJ5t9bN18ZJQnCRs=,tag:1AZyn4Zj1/e/2dhNzcfPqg==,type:str]
     pgp:
         - created_at: "2025-03-07T22:49:16Z"
           enc: |-
diff --git a/secrets/phantom-forgejo-mailer-password.age b/secrets/phantom-forgejo-mailer-password.age
new file mode 100644
index 0000000..90fbe73
Binary files /dev/null and b/secrets/phantom-forgejo-mailer-password.age differ
diff --git a/secrets/phantom-invidious-settings.age b/secrets/phantom-invidious-settings.age
new file mode 100644
index 0000000..6ca9077
--- /dev/null
+++ b/secrets/phantom-invidious-settings.age
@@ -0,0 +1,16 @@
+age-encryption.org/v1
+-> ssh-rsa BwwxHg
+iTcgtxF1IxopbtF+aw7V8IQfH7tWiMk9lE/eWlVHVjeaRvER5W6Y3xZNOFCjtbqY
+VwEyV6ibfZ4GJt1jRu2icEH/AnLUJFFGQnxu/K/rtoZ3tqSIk9WCBv3aPo4oZRiU
+uaaxi2gD8qo1RLyl/Ij7Djw4i/isUOO1EON5sgx1d39k6qUD4Mak0DSU4EtGdTsr
+OaxDAc0kAxhxZQOUH/QlKa0HLonaFcy1LHqvttOcw3UZuZnaYfZiPlcqe3USS9cm
+96aIC5cS9pHr4JFrqRYvfpla2TY5jlCB/xBGw3KjGEIQoBPXSsJZA6BCMZyp00++
+tdfS2aomt9HFmb1wZDS0jWAxkVF6nXXBbolFVih+58h0nYLljtHIQ3SizRoXY459
+x3JE9NReHp2OO3SlIeO03Kv8YMBvj7nSSd1C1PMpu+hJ/eCXi1WQxD6QY+40muk6
+KhqE3PZ8BCY2b+VpywUF5gVH28mo3jscqAzhf2dZ3SQlzldI+hFyKPxTdAqkfUOH
+
+--- cinb+wzjVfTkpfm1CtFIFaepwoQVCj1MquB5rAC45Ew
+�
+6
+ZC�HS07����E�X*�qb=�O����wu����P�����ǖѳ/��mv����2V�ī
+��xv�
[�������̂A~�evd���0��ni�1қ�Q��"�@ٹ���{Kp�:�ϵu�s��B��(X�r[�QVg�T�������@�*����B��.���hE鲟��뒭�����zlz|k�`l8��8�M�cch���Z`� ?yeo�+�M-:/��**���c��ZD�2���&���Ǣ��e��*Hn�"�~+|ua(�6��J
\ No newline at end of file
diff --git a/secrets/phantom-mastodon-mailer-password.age b/secrets/phantom-mastodon-mailer-password.age
new file mode 100644
index 0000000..37232fb
--- /dev/null
+++ b/secrets/phantom-mastodon-mailer-password.age
@@ -0,0 +1,13 @@
+age-encryption.org/v1
+-> ssh-rsa BwwxHg
+Mnc+/tJ0QqxHkg2nl9gEkz5Oj1RgxtOZnD5gRv66ISUOqZhNm1+F+xVEdKn843/q
+/WzH0f1cTF9NXP8vIaEo//bMmp50obJAd+JNovJxV+0gb9L55Nu7ayvK+eyk6j5n
+eb8TxUnwh5BPkEyc6akDh/O49GXzLlVoFD6Ik/0f3YCqUDNAYOl2bsssXtevCeK/
+WEPoCFGhZfNUrOo/0eAhiujZZ5zVb0CWNqXi8VTe2eWOE20VJULcN13TEyO3ZePx
+bAPBmDfS5GgGlV4INWxVLaIMDrzlm0tYozbBNNUbdLFFOhIOrgvay9RWxdk0u2hJ
+MPKoKsJ96EFxrbZJdS0W7a+aZk/Q3A3Civ2rtPx+5UANhmlY8e1lUHa26e1vA4K7
+ApoMtDyCbuZ9FbLurwl9zO64wWP68aKzuyKOIw+wpy41NQ/PcViSY8KNG9Pt7A2N
+CcOkByx+rwz+JdNHbOF8O4FFG4fNSWn7SvVtu5ymGgVi1bOd8PdJpjDR+6Is0SX7
+
+--- DHNyITb7ZseEV58MOD/zHeH5vff0hhlbKg27rlYECGk
+�J�����<hUs/��}��Zi`���'�J��z5��g��%���`��%/���
����-�<x���ɒ|
\ No newline at end of file
diff --git a/secrets/phantom-nextcloud.age b/secrets/phantom-nextcloud.age
new file mode 100644
index 0000000..c180524
--- /dev/null
+++ b/secrets/phantom-nextcloud.age
@@ -0,0 +1,15 @@
+age-encryption.org/v1
+-> ssh-rsa BwwxHg
+bpGCgyaAPDutva1Gp/YPuek6IZTXJHKb7+oIAV/x+7Ry4Oci9zM2VWvPVE/rPE/d
+0AzBX1NvsWBB005w42RfiErk4FQYRCouwNR1FNjUWNdQOmku++RPfxBXspAFIDkQ
+yM7mqbhwf5by5rZY+2kl20QxkErkVtZolus1am9RV4uyXfdPaRcKjWOuPiEim42d
+YdeCXq4nJGxlL3tRunIqLIZGhV08wHBl7Dubhn9hdD6/ekDk0RloVTBDZUY5tUPL
+dJk+bfFPI0DimytzCwyQbWEHOkdiWYSNzbx2JhTSvuqefHP1UzB2LukaQc2gOJFV
+mVKvQuGpOWknytMUhM6zCTvRw4OQutAZd96OniQYTas/vnmfT2l2n9aMEzQK157A
+U9DmsvhBypILiQSPpA7QrGB1QVuRjAFJA86ASY1FAT6MdBBK4vZ8fK7mpT06JO/n
+gwv+UlvFBziWHzA/1GOLrfD+ExjmbeucRZr5XGszrAaK/7GPZt4LF69hRmKegL94
+
+-> 9I3~SC,<-grease M$2 RibFL]C
+uR6MirHtTc4Tyrcw3T2my+BN2Q
+--- 56zk9BqgwQqNymga1mUDgpvtfIpMy5i/JnaSXbjx6jk
+�Q�ޗ�)N��ڦ��ߑ-������Dz-�I��-�]p$�X5�T�PU=u;k�8}w�V�m��=
\ No newline at end of file
diff --git a/secrets/phantom-renawiki.age b/secrets/phantom-renawiki.age
new file mode 100644
index 0000000..cdc2801
--- /dev/null
+++ b/secrets/phantom-renawiki.age
@@ -0,0 +1,16 @@
+age-encryption.org/v1
+-> ssh-rsa BwwxHg
+BUJ9L1bwZ0RWj3FmMghmZDkY4iuc0gujS3Rfat+hj/pg+MALZ69Tovc5RnqmOZT/
+pTGPTzWj3WO70YU+wCUHKZ74JcKdL3wSD1FWOWYRvyDV3gxZjDTjw4Grs+sH9M4Z
+MrhdoyY95fhmGZHJ7Qkx/aKCAK/OaFSu5Vhh37ykmLd1gQ9NJYQ+G3lLr1Mrqjd/
+1QaBqJtJpAFTA0eCd3+oBtQ/qgHD2ZBJcOmkS9sRC6S4YKNoyoDifTbL29aJC4f/
+08myI0WH/ApbtN1hWuiVWibmy/9/76IAvgUqi8fULNY5w7Otz3nKGV+mDA5+oD11
+jCHZJdcec9JFyZ/V2mh/PoHpNawksNPy85eJ0MpM1avM25Qib8kWJM6fnZb7uJzt
+DsYCl2q4ILnTaieuTSJUfgacKbrwSv7MQfgdh1SkXAShyZ7aSCoDhsgSdOVwYoAX
+Mspm0NtodeV7493qZwYspO6H0xbfh20vXa1DOeMt98T1iP0aYYhfRXkb0wACx1QF
+
+-> \z/RLj3S-grease cmv( uCkG*= .cX3S 9r^&
+OVTVTnB3PjD4COiRCtQ
+--- EhfDqxfjLIHF9Sa7V4ytO1xsRK8p23WDsWcB9/B9fRw
+.�=��))/���͹�ҋ#�
�L���Ӊ��|p
+7	���K�7�@�CJf�:w6P�@@/N�7�
\ No newline at end of file
diff --git a/secrets/phantom/default.yaml b/secrets/phantom/default.yaml
index b953bfe..962c6ba 100644
--- a/secrets/phantom/default.yaml
+++ b/secrets/phantom/default.yaml
@@ -8,17 +8,11 @@ example_number: ENC[AES256_GCM,data:R+/m/QVBH9/3DA==,iv:FumBUj97ICrRQmyh5fg8Gu9L
 example_booleans:
     - ENC[AES256_GCM,data:VvI5ag==,iv:koMzyWcua75sK19vuk65oywCD61lMyH3xUwue8LTqy4=,tag:2ym1M0FTwevLm7wefTUWAw==,type:bool]
     - ENC[AES256_GCM,data:lFEC/S8=,iv:cJWbnmseP/AqJzyORM+VI5y7rK8axVeh7EXoLP7mT/Q=,tag:BaS5HyecokdLCq+LzQxGkg==,type:bool]
-forgejo:
-    smtp_password: ENC[AES256_GCM,data:g/Uqmtp8A9pas5WcslwnGCKSXv7dYSRMA8wKm7DWpvssVRZJ,iv:vNBqdTlZ5mg0AhjMNr8rUts1rDBYmq03tdiceVN3xjs=,tag:M3qfiZEWvJN/XUjjmnAXqA==,type:str]
-invidious:
-    settings.json: ENC[AES256_GCM,data:wzbBnj3qrhw+clHpetEm/FYs+zkMM0kG0JO97E2wPEPaoBZDuOy3BRAbzmwkn4RUEt2hWVN89/A1qweXuuScXt5LSgaQXFXmGQQ2RzXY7K7Pr3uBNol53pnNQI5M6Mi1bif26rdiwznE0QgZCuptadhPcHbCaWB2QrXyYDdTdvQ6Wd+ZueSXPXCjpRnXaqZzTFc5VJf09wqTFahUvVkgjkhgiLVUu218b8xghekJLwJ3bKwmXuXsnmGSQjFry6ttbFPQJawVXWqsiNY7iaE0k1K3NKcTu5Fm2XiriPTKuGM51EXrqaw97ywWN8JEBGxZTk7kcWg2tAf9ddOewYMG,iv:2oDgPdFihZ9O8IkAydL2DtlUtCBUw70u2F2Rn+eW9rs=,tag:zvdZbEdQzbtWgft+i00ufQ==,type:str]
-mastodon:
-    smtp-password: ENC[AES256_GCM,data:ciRTgcCKueSiYerBjWHOD4c9wlpMlcV9jiFaEWFh92vgA6J9,iv:TAaPiMIL8Yfd9k4j9dN40dWqQWAPb+24ngvPC7GTrlE=,tag:+7fGAN7FKiPIWvdsQXGqxg==,type:str]
-nextcloud:
-    default-password: ENC[AES256_GCM,data:mR0KRCheXh6NBVn+odK9Kx0e4njJDuZ6OS37Iw==,iv:PAb/sCt7hq5WKZwr4FMfiMqf7mGvpXQEnZcbzmDz9oI=,tag:ukBDHbFKrStXckzuE1TwJA==,type:str]
-writefreely:
-    password: ENC[AES256_GCM,data:5hzvM8Aitvj4Hb/RgViV1QjsnpQqln0k1nZvEz8Y7vdZvcHo,iv:Wi+pKcGqi09050sitgxt/+hYGF2mlmYC0SDjmqSWPr4=,tag:V0KSBgIV4fgMbxuADVTxrA==,type:str]
 sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
     age:
         - recipient: age1zrgu7w8059xydagm60phnffghvfe9h2ca58cx8qwagqpyfuvs9fqw79c8h
           enc: |
@@ -38,8 +32,8 @@ sops:
             RU1HSUhldHpzeURaUWQvcjBCQ3pMY2cKYL87Njs4e68zu5AXKNF/hxiB3HduS8wz
             o0kmGI58DZx17+Cdipw0ab9a9wiu9C9Fn+LaiCcdM/ESXtS79RzdbQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-02-15T06:46:07Z"
-    mac: ENC[AES256_GCM,data:lnvq80oOH2pO6AxBbnjNxvz0xcukTFowcxKf24RKFf/ZouRL6uCJEWJwNCoAKCGOHibrztsGHLDL/cgOffv9CTivIYmzbB+9q2MCQNGxrSL7CkWr/mK9xb5Yz1ASvvZxcGB7WmZNVZXvjIr6mdZy50UweHJoit+oDvE03cmG9Bw=,iv:CikhhcnCE9SXpRasZEImUR6vU5cauD4YIplxPYsPo4A=,tag:+QaBv8Nrk40UCYhUskepyw==,type:str]
+    lastmodified: "2025-03-05T22:27:18Z"
+    mac: ENC[AES256_GCM,data:WSopSnWZ+uOllywd7difaZtJcfxkL7eIf9Kr3GajZKO0+rP6pEHIS+5AbXZy6oKRlCLUPecY/WXFvk3//akpvvXHbf6Jp4fQ/YSuTcYKRQupbDBpOXSlc33QyRl6oEyiMOjxMxa2N2tmq8dmA0NbF9wSDMa5a4eNDoiL5T/sUZ8=,iv:QqbVRApzFF6q24rk8KfKuthj656nEczD9Si4INj+N9A=,tag:tMRNYo+u/jIQ6iX3KqKJdA==,type:str]
     pgp:
         - created_at: "2025-03-07T22:49:19Z"
           enc: |-
@@ -57,4 +51,4 @@ sops:
             -----END PGP MESSAGE-----
           fp: 0FECE8316E74BA6F44EFC21A2F8F21CE8721456B
     unencrypted_suffix: _unencrypted
-    version: 3.11.0
+    version: 3.9.4-unstable
diff --git a/secrets/rainbow-gitlab-runner-thoreb-itinerario-registrationConfigFile.age b/secrets/rainbow-gitlab-runner-thoreb-itinerario-registrationConfigFile.age
new file mode 100644
index 0000000..03118e3
--- /dev/null
+++ b/secrets/rainbow-gitlab-runner-thoreb-itinerario-registrationConfigFile.age
@@ -0,0 +1,13 @@
+age-encryption.org/v1
+-> ssh-rsa BwwxHg
+KCVF4Sy49stOeQs2uunYKkvadqeimmWlJ4ucEJxfXy2z+OkkZpixUnWgJEH2nCa4
+NL/F0Wezbqvh+Texl4FlHN8PT2w/d5gdg/L+fI4jBYCvbbiHA4sdUgmXWigY8zrU
+5H7Y9mgb1Y174fA6zfTCk2fHmk+KARoV27YrS2fzGoVQiPhnvv8ZT51eF1E+Zs4I
++YtXehxEOqYljJKYJJnF9ElzfNa8nypACGtcjTE8eEq0DlZu2U7qV+QWwQudHbcs
+MbFR2VtkHWQaNdK1vVBGND1CMlfshSCqbUzGcexownMiCVSal1RKA2uAWnYdOEc/
+QSR8cKn8QQ5dyPFCqZ8RnlCMUegCVLg5cC0/rlTUD0C/Ti2SRBYTH3HvJjmSNk8k
+3LdcNwK4YtG4d1gkqLVjwCM1Yg8I/UICb5nQYclvBz5VQ2drvL/gU/+Vc7Z5KUFI
+0G/7uNmeJ16Eky+X9c73ZZxVqm0TzDENE2GzkPhBHEfXBR+4j6m8KKEWxQmA2ZSg
+
+--- Oq9wU0h90iU/8g1XTNI+LuAg7t09hngj9DCK91V1+pg
+χv��P���}�N,��Wl?y0)�eVw��A�i���ŐSm�������>���D��Q��C-��B������0��V�|�=�X�6�� ���W�>���~�-qI�%
\ No newline at end of file
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
new file mode 100644
index 0000000..6504054
--- /dev/null
+++ b/secrets/secrets.nix
@@ -0,0 +1,19 @@
+let
+  main_ssh_public_key = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCxR/w+38b2lX90yNBqhq3mUmkn1WGu6GAPhN1tVp2ZjYRJNV/+5gWCnTtOWYtDx35HmK/spQ2Qy8X9ttkzORa24fysNx1Iqn/TiXhD7eIJjbGPnrOpIKTkW5/uB3SD/P5NBSa06//BaqJU4sBlG79hoXRpod052hQtdpTVDiMCIV+iboWPKqopmJJfWdBtVnHXs9rep0htPRExxGslImFk7Z6xjcaHyCpIQZPlOGf+sGsmUU7jRqzvZFV8ucIdbnAlMHrU4pepNFhuraESyZVTa/bi9sw0iozXp5Q5+5thMebEslmT1Z771kI4sieDy+O4r8c0Sx2/VY1UAzcpq1faggc3YB01MTh+tiEC6xdMvZLrQGL1NBWjHleMyL53GU5ERluC0vXJF3Hv3BGGBDfXWbrEm5n06DHr2apRVJGC0LwiQ7Woud1X4V4X1pKSusxCVMjT2lmcOwV6YhKhB2sowJc1OdMx4+tL0UWE+YKSZgBHfolwk6ml0F4EO9nnUHc= lelgenio@i15";
+in
+{
+  "monolith-gitlab-runner-thoreb-itinerario-registrationConfigFile.age".publicKeys = [
+    main_ssh_public_key
+  ];
+  "gitlab-runner-thoreb-telemetria-registrationConfigFile.age".publicKeys = [ main_ssh_public_key ];
+  "monolith-forgejo-runner-token.age".publicKeys = [ main_ssh_public_key ];
+  "lelgenio-cachix.age".publicKeys = [ main_ssh_public_key ];
+  "monolith-nix-serve-privkey.age".publicKeys = [ main_ssh_public_key ];
+  "factorio-settings.age".publicKeys = [ main_ssh_public_key ];
+  "phantom-nextcloud.age".publicKeys = [ main_ssh_public_key ];
+  "phantom-writefreely.age".publicKeys = [ main_ssh_public_key ];
+  "phantom-renawiki.age".publicKeys = [ main_ssh_public_key ];
+  "phantom-forgejo-mailer-password.age".publicKeys = [ main_ssh_public_key ];
+  "phantom-mastodon-mailer-password.age".publicKeys = [ main_ssh_public_key ];
+  "phantom-invidious-settings.age".publicKeys = [ main_ssh_public_key ];
+}
diff --git a/switch-with-home-cache b/switch-with-home-cache
new file mode 100755
index 0000000..cff021a
--- /dev/null
+++ b/switch-with-home-cache
@@ -0,0 +1,6 @@
+#!/bin/sh
+
+./switch \
+    --option extra-substituters "http://nixcache.lelgenio.1337.cx:5000" \
+    --option extra-trusted-public-keys "nixcache.lelgenio.1337.cx:HZCwDaM39BOF+MLuviMQTUrz3rBWLTLV9H+GV4zcxVI=" \
+    "$@"
diff --git a/system/monolith-forgejo-runner.nix b/system/monolith-forgejo-runner.nix
index 5d7a98f..3297514 100644
--- a/system/monolith-forgejo-runner.nix
+++ b/system/monolith-forgejo-runner.nix
@@ -6,7 +6,7 @@
       enable = true;
       name = "monolith";
       url = "https://git.lelgenio.com";
-      tokenFile = config.sops.secrets."forgejo-runners/git.lelgenio.com-default".path;
+      tokenFile = config.age.secrets.monolith-forgejo-runner-token.path;
       labels = [
         # provide a debian base with nodejs for actions
         "debian-latest:docker://node:18-bullseye"
@@ -17,6 +17,4 @@
       ];
     };
   };
-
-  sops.secrets."forgejo-runners/git.lelgenio.com-default" = { };
 }
diff --git a/system/nix-serve.nix b/system/nix-serve.nix
index 9bf9814..6cc7161 100644
--- a/system/nix-serve.nix
+++ b/system/nix-serve.nix
@@ -7,8 +7,6 @@
 {
   services.nix-serve = {
     enable = true;
-    secretKeyFile = config.sops.secrets."nix-serve/private-key".path;
+    secretKeyFile = config.age.secrets.monolith-nix-serve-privkey.path;
   };
-
-  sops.secrets."nix-serve/private-key" = { };
 }
diff --git a/system/nix.nix b/system/nix.nix
index 7ab2e28..482bb93 100644
--- a/system/nix.nix
+++ b/system/nix.nix
@@ -29,12 +29,16 @@ in
       substituters = [
         "https://cache.nixos.org"
         "https://nix-community.cachix.org"
+        # "http://nixcache.lelgenio.1337.cx:5000"
+        "https://lelgenio.cachix.org"
         "https://wegank.cachix.org"
         "https://snowflakeos.cachix.org/"
       ];
       trusted-public-keys = [
         "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
         "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
+        # "nixcache.lelgenio.1337.cx:zxCfx7S658llDgAUG0JVyNrlAdFVvPniSdDOkvfTPS8="
+        "lelgenio.cachix.org-1:W8tMlmDFLU/V+6DlChXjekxoHZpjgVHZpmusC4cueBc="
         "wegank.cachix.org-1:xHignps7GtkPP/gYK5LvA/6UFyz98+sgaxBSy7qK0Vs="
         "snowflakeos.cachix.org-1:gXb32BL86r9bw1kBiw9AJuIkqN49xBvPd1ZW8YlqO70="
       ];
diff --git a/system/secrets.nix b/system/secrets.nix
new file mode 100644
index 0000000..588dfe4
--- /dev/null
+++ b/system/secrets.nix
@@ -0,0 +1,12 @@
+{ pkgs, config, ... }:
+{
+  age = {
+    identityPaths = [ "/root/.ssh/id_rsa" ];
+    secrets.lelgenio-cachix.file = ../secrets/lelgenio-cachix.age;
+    secrets.monolith-gitlab-runner-thoreb-itinerario-registrationConfigFile.file = ../secrets/monolith-gitlab-runner-thoreb-itinerario-registrationConfigFile.age;
+    secrets.gitlab-runner-thoreb-telemetria-registrationConfigFile.file = ../secrets/gitlab-runner-thoreb-telemetria-registrationConfigFile.age;
+    secrets.monolith-forgejo-runner-token.file = ../secrets/monolith-forgejo-runner-token.age;
+    secrets.monolith-nix-serve-privkey.file = ../secrets/monolith-nix-serve-privkey.age;
+    secrets.phantom-forgejo-mailer-password.file = ../secrets/phantom-forgejo-mailer-password.age;
+  };
+}
diff --git a/user/home.nix b/user/home.nix
index 5d94b46..c8dd8c1 100644
--- a/user/home.nix
+++ b/user/home.nix
@@ -114,6 +114,9 @@
     deluge
     nicotine-plus
 
+    ## Nix secrets management
+    inputs.agenix.packages.x86_64-linux.default
+
     ## Programming
     # rustup