# Secrets decrypted on mibook. sopsFile defaults to secrets/mibook.yaml
# via machines/core/sops.nix.
{ ... }:
{
  # Pipeline smoke test — proves host-key decryption works end to end.
  # Safe to delete once a real secret is in place.
  sops.secrets.placeholder = {
    mode = "0400";
    owner = "root";
    group = "root";
  };
}