{
  mkServiceSecrets =
    service: secretsPath: secrets:
    builtins.listToAttrs (
      map (sec: {
        name = service + "-" + sec;
        value = {
          owner = service;
          group = service;
          file = secretsPath + /${service}/${sec}.age;
        };
      }) secrets
    );
}