it might make more sense to make this a runtime path (/run/secrets/...)
sane.gui.plasma.enable
machines
hosts
hardware
modules
hosts/common
image.nix