diff --git a/.gitattributes b/.gitattributes
index cb2a0c9..4fae3bb 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -1,3 +1,4 @@
 flake.lock -diff
+*.age -text -diff
 *.css linguist-detectable=false
 *.css linguist-generated=true
diff --git a/secrets/forgejo-runner-token.age b/secrets/forgejo-runner-token.age
new file mode 100644
index 0000000..18a7501
--- /dev/null
+++ b/secrets/forgejo-runner-token.age
@@ -0,0 +1,6 @@
+age-encryption.org/v1
+-> ssh-ed25519 ZfCryg dcBOsnptC6CR1PGCbRIL087/tMc4LWvTR4r3f58rCiI
++xWxAQfCy7tgcxZAxxX2a/Ar40IspPUPpZVQyuPNsoU
+--- 8LEM/+6yxdMP8e5Y8mdTtCnCDlptaTGTCqiUlPFJeqw
+����+
+�jb�G���c|4||*_�xPǻ�9�Q�&�l�+b���T�S�9��ҿb�G:�R�7����V�JЁ�Z
\ No newline at end of file
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
new file mode 100644
index 0000000..b49380b
--- /dev/null
+++ b/secrets/secrets.nix
@@ -0,0 +1,8 @@
+let
+  pingu = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILPbmiNqoyeKXk/VopFm2cFfEnV4cKCFBhbhyYB69Fuu";
+  elissa = "";
+  users = [pingu elissa];
+in {
+  "forgejo-runner-token.age".publicKeys = [pingu];
+  "vaultwarden-env.age".publicKeys = [pingu];
+}
diff --git a/secrets/vaultwarden-env.age b/secrets/vaultwarden-env.age
new file mode 100644
index 0000000..307d33b
Binary files /dev/null and b/secrets/vaultwarden-env.age differ