diff --git a/.gitmodules b/.gitmodules
index d9753d11..b8fee3f7 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -11,8 +11,8 @@
 	path = home-common/graphical/rofi/zzzfoo
 	url = https://github.com/andersju/zzzfoo.git
 [submodule "modules/cdarknet/hosts"]
-	path = system/modules/cdarknet/hosts
+	path = system/cdarknet/hosts
 	url = git@git.darmstadt.ccc.de:cdark.net/hosts
 [submodule "modules/cdarknet/nixdark"]
-	path = system/modules/cdarknet/nixdark
+	path = system/cdarknet/nixdark
 	url = git@git.darmstadt.ccc.de:cdark.net/nixdark
diff --git a/home-manager/default.nix b/home-manager/default.nix
index 83c1a081..a6257630 100644
--- a/home-manager/default.nix
+++ b/home-manager/default.nix
@@ -105,19 +105,20 @@
 
   imports = [
     ./taskwarrior.nix
-    ../modules/force-copies.nix
+    ./force-copies.nix
   ];
 
   home.packages = with pkgs; [
     htop
     tree
-    rxvt_unicode.terminfo
+    st.terminfo
     most
 
     socat
     nmap
     tcpdump
 
+    git-crypt
     rcm
     tmux
     tig
diff --git a/system/modules/cdarknet/default.nix b/system/cdarknet/default.nix
similarity index 100%
rename from system/modules/cdarknet/default.nix
rename to system/cdarknet/default.nix
diff --git a/system/modules/cdarknet/hosts b/system/cdarknet/hosts
similarity index 100%
rename from system/modules/cdarknet/hosts
rename to system/cdarknet/hosts
diff --git a/system/modules/cdarknet/nixdark b/system/cdarknet/nixdark
similarity index 100%
rename from system/modules/cdarknet/nixdark
rename to system/cdarknet/nixdark
diff --git a/system/default.nix b/system/default.nix
index 1b6269ff..d6bf02eb 100644
--- a/system/default.nix
+++ b/system/default.nix
@@ -3,10 +3,11 @@
   # channel = 18.03
 
   imports = [
+    ./secret-option.nix
     ./laptop.nix
     ./admin.nix
     ./syncthing.nix
-    modules/cdarknet
+    ./cdarknet
   ];
 
   i18n = {
@@ -37,6 +38,7 @@
 
   environment = {
     systemPackages = with pkgs; [
+      git-crypt
       git
       gnumake
       python3
diff --git a/system/laptop.nix b/system/laptop.nix
index 9c3c732b..a3a3ca79 100644
--- a/system/laptop.nix
+++ b/system/laptop.nix
@@ -1,4 +1,5 @@
-{ config, pkgs, ... }:
+{ config, pkgs, lib, ... }:
+with lib;
 {
   options = {
     m-0.laptop.enable = mkOption {
diff --git a/system/secret-option.nix b/system/secret-option.nix
new file mode 100644
index 00000000..5b4bc69b
--- /dev/null
+++ b/system/secret-option.nix
@@ -0,0 +1,10 @@
+{ config, pkgs, lib, ... }:
+with lib;
+{
+  options = {
+    m-0.secrets = mkOption {
+      default = {};
+      type = types.attrs;
+    };
+  };
+}
diff --git a/system/secret/.gitattributes b/system/secret/.gitattributes
new file mode 100644
index 00000000..5ccf582d
--- /dev/null
+++ b/system/secret/.gitattributes
@@ -0,0 +1,2 @@
+* filter=git-crypt diff=git-crypt
+.gitattributes !filter !diff
diff --git a/system/secret/default.nix b/system/secret/default.nix
new file mode 100644
index 00000000..5bcc019c
Binary files /dev/null and b/system/secret/default.nix differ