{ pkgs, config, lib, ... }:

{
  # Forgejo
  services.forgejo.settings.database.PASSWORD = "changeme_forgejo_db";

  # Stalwart Mail
  services.stalwart.settings.authentication.fallback-admin.secret = "changeme_stalwart_admin";

  # Searx
  services.searx.settings.server.secret_key = "changeme_searx_secret";

  # Minecraft RCON
  services.minecraft-servers.servers.fabric.serverProperties."rcon.password" = "changeme_rcon";

  # Tailscale Auth Key (needs to be a file for the service usually, or use pre-auth)
  # For Tailscale, standard module uses 'authKeyFile'. 
  # We can create a file in the store for it since this is an impure secrets file anyway.
  
  # For Tailscale, let's just write valid one-liner to a file via environment.etc if needed, 
  # or use the 'authKey' option if available (it is not, usually).
  # We will stick to environment.etc JUST for Tailscale or file-based secrets.
  environment.etc."secrets/tailscale-auth".text = "tskey-auth-PLACEHOLDER";
  services.tailscale.authKeyFile = "/etc/secrets/tailscale-auth";
}