{config, ...}: {
  services.gitlab = {
    initialRootPasswordFile = config.age.secrets."services/gitlab/initialRootPasswordFile".path;
    secrets = {
      dbFile = config.age.secrets."services/gitlab/dbFile".path;
      jwsFile = config.age.secrets."services/gitlab/jwsFile".path;
      otpFile = config.age.secrets."services/gitlab/otpFile".path;
      secretFile = config.age.secrets."services/gitlab/secretFile".path;
    };
  };

  age.secrets = {
    "services/gitlab/dbFile".owner = "gitlab";
    "services/gitlab/jwsFile".owner = "gitlab";
    "services/gitlab/otpFile".owner = "gitlab";
    "services/gitlab/secretFile".owner = "gitlab";
    "services/gitlab/initialRootPasswordFile".owner = "gitlab";
  };
}