idea: have sops encrypted secret yamls, specify them in Nix, get all secret yamls in a single directory to push into oci repo for flux to use
