machines-config/secrets/secrets.nix

let
  keyfile = builtins.fromJSON (builtins.readFile ./keys.json);

  splitString = delim: str: builtins.filter builtins.isString (builtins.split delim str);

  getKey = pair: keyfile.${builtins.elemAt pair 0}.${builtins.elemAt pair 1};

  getKeys = secretName: builtins.map (x: getKey (splitString ":" x)) keyfile.secrets.${secretName};
in
{
  "mypassword.age".publicKeys = getKeys "mypassword.age";
}