diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000..155ce01
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1 @@
+secret-config.nix filter=git-crypt diff=git-crypt
diff --git a/nixos/server/default.nix b/nixos/server/default.nix
index ff90efa..ae70be7 100644
--- a/nixos/server/default.nix
+++ b/nixos/server/default.nix
@@ -10,9 +10,6 @@
   ];
 
   kekleo.graphical = false;
-  kekleo.publicKeys = [
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOsLFjdS9JEcgBPa6NvOzpJp8coJPJwJFuM+PQCZ8brl leonhard"
-  ];
 
   users.users.leonhard = {
     initialPassword = "leonhard";
diff --git a/nixos/server/secrets/default.nix b/nixos/server/secrets/default.nix
index 0352720..aabd0da 100644
--- a/nixos/server/secrets/default.nix
+++ b/nixos/server/secrets/default.nix
@@ -3,6 +3,10 @@
   ...
 }:
 {
+  imports = [
+    ./secret-config.nix
+  ];
+
   sops.secrets.dyndns = {
     format = "dotenv";
     sopsFile = ./dyndns.env;
diff --git a/nixos/server/secrets/secret-config.nix b/nixos/server/secrets/secret-config.nix
new file mode 100644
index 0000000..9956c53
Binary files /dev/null and b/nixos/server/secrets/secret-config.nix differ