{ config, ... }:
{
    sops.templates."cloudflare-api-token.yaml" = {
        mode = "0444";
        content = ''
            apiVersion: v1
            kind: Secret
            metadata:
                name: cloudflare-api-token
                namespace: cert-manager
            type: Opaque
            stringData:
                api-token: ${config.sops.placeholder.cloudflare_api_token}
        '';
        path = "/var/lib/rancher/k3s/server/manifests/secrets/cloudflare-api-token.yaml";
    };
}