{ config, pkgs, lib, ... }: let cfg = config.local.programs.pass; pass = pkgs.pass.withExtensions (ext: [ ext.pass-audit ext.pass-update ext.pass-otp ]); in { options.local.programs.pass.enable = lib.mkEnableOption "pass"; config = lib.mkIf cfg.enable { environment.systemPackages = [ pass ]; services.passSecretService.enable = true; }; }