{ lib, ... }:
{
  security.lockKernelModules = false;
  security.virtualisation.flushL1DataCache = lib.mkForce null;
  security.gnupg.agent = {
    keyring."C7BCEA3D090956E7D51E94ADFF53191D9FA89552" = {
      passwordGpg = "gnupg/root.gpg";
      passwordFile = "/root/.gnupg.C7BCEA3D090956E7D51E94ADFF53191D9FA89552.txt";
    };
  };
  services.openssh.extraConfig = ''
    # This is for removing remote gpg-agent's socket
    StreamLocalBindUnlink yes
  '';
}