{ pkgs, lib, config, ... }:
with lib;
{
  options.tools.secrets = {
    enable = mkEnableOption "Enable secret-management tools";
  };
  
  config = mkIf config.tools.secrets.enable {
    environment.systemPackages = [ pkgs.git-crypt ];
  };
}