diff --git a/.sops.yaml b/.sops.yaml
index 1ce5024..0d7bb80 100644
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -4,10 +4,8 @@
 # for a more complex example.
 keys:
   - &A_sky age1g4j0hun2ttt7h8870zf5pm7nqgw9p23r6mjj9vpm4guqetvth34s8v3t3w
-  - &S_tofu age1mfsjys8gzazkzurcpz2grcdljmzq0zvsllk8j7ssse6wt52jrglq5t59u8
 creation_rules:
   - path_regex: secrets\.yaml
     key_groups:
       - age:
           - *A_sky
-          - *S_tofu
diff --git a/configurations/nixos/tofu/default.nix b/configurations/nixos/tofu/default.nix
index 28a5cdc..5a6cb47 100644
--- a/configurations/nixos/tofu/default.nix
+++ b/configurations/nixos/tofu/default.nix
@@ -1,11 +1,6 @@
 # See /modules/nixos/* for actual settings
 # This file is just *top-level* configuration.
-{
-  flake,
-  modulesPath,
-  config,
-  ...
-}:
+{ flake, modulesPath, ... }:
 
 let
   inherit (flake) inputs;
@@ -20,7 +15,6 @@ in
     tty-ips.enable = true;
     otf = {
       enable = true;
-      environmentFile = config.sops.secrets.otfenv.path;
     };
   };
   networking = {
diff --git a/modules/flake/devshell.nix b/modules/flake/devshell.nix
index 96412b6..85fbfb0 100644
--- a/modules/flake/devshell.nix
+++ b/modules/flake/devshell.nix
@@ -6,7 +6,6 @@
         name = "nixos-unified-template-shell";
         meta.description = "Shell environment for modifying this Nix configuration";
         packages = with pkgs; [
-          ssh-to-age
           sops
           just
           nixd
diff --git a/modules/nixos/common/otf.nix b/modules/nixos/common/otf.nix
index bbc8e03..da9284a 100644
--- a/modules/nixos/common/otf.nix
+++ b/modules/nixos/common/otf.nix
@@ -19,7 +19,7 @@ in
     };
     package = lib.mkPackageOption pkgs "otf" { };
     pgPackage = lib.mkPackageOption pkgs "postgresql_16" { };
-    environmentFile = lib.mkOption {
+    environmentFile = lib.mkEnableOption {
       type = with lib.types; nullOr path;
       default = lib.types.null;
     };
@@ -36,11 +36,14 @@ in
         );
       default = {
         OTF_ADDRESS = "localhost:9000";
-        # OTF_SITE_TOKEN = "my-token";
-        # OTF_SSL = "false";
-        # OTF_SECRET = "";
-        # OTF_CERT_FILE = "";
-        # OTF_KEY_FILE = "";
+        OTF_SITE_TOKEN = "my-token";
+        OTF_SSL = "false";
+        # the application needs a secret for encryption and other things
+        # TODO: make mechanism to load via file
+        OTF_SECRET = "f73e55eada59bd1c37d69ae3bbacd982";
+        # more options can be set but these are a reminder for myself
+        OTF_CERT_FILE = "";
+        OTF_KEY_FILE = "";
       };
       description = "Environment variables for the OTF service.";
     };
diff --git a/modules/nixos/common/sops.nix b/modules/nixos/common/sops.nix
index d40a964..beb3ad4 100644
--- a/modules/nixos/common/sops.nix
+++ b/modules/nixos/common/sops.nix
@@ -9,14 +9,5 @@
   imports = [
     flake.inputs.sops-nix.nixosModules.sops
   ];
-  sops = {
-    defaultSopsFile = ../../../secrets.yaml;
-    secrets = {
-      otfenv = {
-        owner = "otf";
-        group = "otf";
-        mode = "0440";
-      };
-    };
-  };
+  sops.defaultSopsFile = ../../../secrets.yaml;
 }
diff --git a/secrets.yaml b/secrets.yaml
index f901c48..7a2d112 100644
--- a/secrets.yaml
+++ b/secrets.yaml
@@ -1,25 +1,25 @@
-otfenv: ENC[AES256_GCM,data:HwZC2IPM9w5FqFlpc/zLA+m9bSC6m19hnvuS103Iwct84QM/HHkez3pdLdCZM5tNZN+oItxMHcIizbcA7mQn1eezdt+Pb9RC4hk=,iv:rcvPhmVEg79XPpJ6o8/DBP4YgN+lgjvxLB1mJYARdCo=,tag:SSZiiKngO+vWjcEppnhARg==,type:str]
+hello: ENC[AES256_GCM,data:Rq1GdoMwMFgQ7Bvy78aMmM6DferRk0Bn5J4VVI8a5x2PaaFbZBAfsADZewD8,iv:sgJJM2UO4KZ+qE8uzNmdhsBhJ3/arEZd4kNvqnK2bqo=,tag:FZHKmkX1VfQLYPP0mDTIiQ==,type:str]
+example_key: ENC[AES256_GCM,data:h6UKojkibcw0wegDOQ==,iv:XVb8m9Ek4pNl6CCFU1MlxYusIOY6MBq9Z7lqoaG1/cM=,tag:FolHw4euj4PoqnTuuhlh4w==,type:str]
+#ENC[AES256_GCM,data:2ivQ7NDtZHDNMiyK8hf/7Q==,iv:sFv9WyyHJb+tkbjRGnD4OfEYJWt8PQIGteIViVyihEU=,tag:chbHtXfFQb5OJsB3rrMQbg==,type:comment]
+example_array:
+    - ENC[AES256_GCM,data:EQKOFW+qJ0Z/ooEr9Y0=,iv:732cR53nJfxctdVH0AZmfD/qBPoI7oPxemsYo4B92jQ=,tag:VMSYfVzTUAODwNtdz0xI6g==,type:str]
+    - ENC[AES256_GCM,data:3N1qsEA4L4YTw4qZjvs=,iv:mdCoLmqRA5OX3VpNM/f1AhmRIxOBvTswEvwPRadeYCQ=,tag:z9nueE2d4Kb/uWSCvK55jA==,type:str]
+example_number: ENC[AES256_GCM,data:PSY/N8noNaQYug==,iv:189g+CnKC5lBdJBBTcA4HUC3i98ZXa5thARY8U42DyI=,tag:hdWoyngTGnBszqCW3I+wXQ==,type:float]
+example_booleans:
+    - ENC[AES256_GCM,data:SFFumQ==,iv:G2iEbkil+oUuJCyxQAfaAMaXHPsOdAtdw8l8dnvqviY=,tag:WPfOOyjrWf/4p2UjoiILAQ==,type:bool]
+    - ENC[AES256_GCM,data:2GWLfxY=,iv:nSqxDcqvUeIDbvOoJlhW/lQs9j2iENsazpuZFUoOKc8=,tag:eh3HVtgzBrJjf0S9lGiqGQ==,type:bool]
 sops:
     age:
         - recipient: age1g4j0hun2ttt7h8870zf5pm7nqgw9p23r6mjj9vpm4guqetvth34s8v3t3w
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3MGZ5Z25rZjh1b2E5eWZk
-            ZUpyZXhrZVdtRTlCTUovMFd5dWpmZERtc0NvCk01UUdxVHFFZVliTDU2bmpSeWpK
-            My84a1Q3SzcyR0xQSHlQQmROaFlkOEEKLS0tIFBMaCtEbVhRb2tRcDBkS2Nkc3hO
-            eGtzRVVLamtXOEJEbDUvRHVaNDlaOVUKGDG+gUXU7GcvpfkgIStYg8KIW0jY2NTh
-            /eKWOfuH/8zz25Ye8zS1s7Yp5WiXi3rJSY2qS8PFq9PTmBzVEFoVpQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3aFBMUWVvV1UzRlgvaGd5
+            TWtUd1VEa0RyYmxRUy9MVzA0OXdLOFU2MkhrCmMxYlVSZjFlSW9lN3RvUm8rUUht
+            N05aSUZ5UU51ZSt0Vzg3ZjkwRXVKSzAKLS0tIFJIaUtqMXhLcDZ3cnYyWFJRZ20z
+            cVpseXdzZHh6amduSFBUT1RMdkcxS2MKJhBQbcufwWc+kxFf/k/pHLClnPJkUucH
+            6kEbeF+T49PoyxWyR1oXWhxC6Xuwcx+w3vA59gvP54Bx2Mrj2ylYwQ==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1mfsjys8gzazkzurcpz2grcdljmzq0zvsllk8j7ssse6wt52jrglq5t59u8
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4VjRvcjQyV25McEZYSEVV
-            d0pON0NnUDlFdGZzaE9KZitSY09ISCt3VlhRCkx6MitueW5PYUdMWU4wRmVhTTJU
-            RkpWakNlYVlzcHVOT3gxdHZKUjJla1UKLS0tIG9SYTlUOXcwNFNzT29FazE4Z0g0
-            MlJ1bjRvS0VQMkRFSG0yNDc5Y3lSM28KS50BUA6S61AJYZRefGbW76TotkDOv1FD
-            Q1CyfEDDkrhbUPtPeOagG3tStP9ZfkRRfmm7TzkB4PfHDTpfAg6V/g==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-06-14T18:56:57Z"
-    mac: ENC[AES256_GCM,data:oPKok5QCr8edihXzZUZl3+5Abss6OMas4rYqQZWeLkkIX+b3uzCi0p6KJsZK1SyxZC48Wa4ax8cGLb1BOIQVCjyR80OkXDzQACee9War2LVceXcoT1ARqgl21nthmckLxYzs+YOxWbB3gFQNOD09aeenLpSJUzMM7kDV901sCVg=,iv:ywJaJYj2xrNkgQsWZJF51ZUAwBwMk14eQDe9EC6EXaQ=,tag:GQlHIofanq/yETLbAqS2Nw==,type:str]
+    lastmodified: "2025-06-14T17:54:53Z"
+    mac: ENC[AES256_GCM,data:wxaNv7XOLCWKkrvESr4R09sVTxbm9Otm6ImuaCbFMKuZlvAsp93wi54W5YK+aOugZtMfEBrz648A7GaR0ahb0ggvuhiHgCH667dMGBUZCp81vVBvF5RMhoPaR6IXnrdlQN4ypmbj3p07T+1BBMG6MJVieoI/liHMn//UDbWWOKQ=,iv:Y1ZS1gIGnwABpTNx3afjTHMGRxr3iu2t9uvwZ6RR0Wc=,tag:+uwoTYioDywkke9gMhEkkA==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.10.2