NixOS and Secrets / hacker news