diff --git a/.git-crypt/.gitattributes b/.git-crypt/.gitattributes
new file mode 100644
index 0000000..665b10e
--- /dev/null
+++ b/.git-crypt/.gitattributes
@@ -0,0 +1,4 @@
+# Do not edit this file.  To specify the files to encrypt, create your own
+# .gitattributes file in the directory where your files are.
+* !filter !diff
+*.gpg binary
diff --git a/.gitattributes b/.gitattributes
index 24a8e87..a61cc42 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -1 +1,2 @@
 *.png filter=lfs diff=lfs merge=lfs -text
+*.enc filter=git-crypt diff=git-crypt
diff --git a/hosts/common/pkgs.nix b/hosts/common/pkgs.nix
index 431f572..793c055 100644
--- a/hosts/common/pkgs.nix
+++ b/hosts/common/pkgs.nix
@@ -1,14 +1,15 @@
-{ pkgs, ... }:
-
-{
-  imports = [ ];
-
-  environment.systemPackages = with pkgs; [
-    git
-    git-lfs
-    gnupg
-    home-manager
-    ntfsprogs
-    wget
-  ];
-}
+{ pkgs, ... }:
+
+{
+  imports = [ ];
+
+  environment.systemPackages = with pkgs; [
+    git
+    git-lfs
+    git-crypt
+    gnupg
+    home-manager
+    ntfsprogs
+    wget
+  ];
+}
diff --git a/hosts/gitea/services/default.nix b/hosts/gitea/services/default.nix
index cb3cfb4..466b2a8 100644
--- a/hosts/gitea/services/default.nix
+++ b/hosts/gitea/services/default.nix
@@ -1,7 +1,7 @@
-{ ...} : {
-  imports = [
-    ./gitea.nix
-    ./postgres.nix
-    ./sshd.nix
-  ];
-}
\ No newline at end of file
+{ ...} : {
+  imports = [
+    ./gitea.nix
+    ./postgres.nix
+    ./sshd.nix
+  ];
+}
diff --git a/hosts/gitea/services/sshd.nix b/hosts/gitea/services/sshd.nix
index e9c0405..9051c4b 100644
--- a/hosts/gitea/services/sshd.nix
+++ b/hosts/gitea/services/sshd.nix
@@ -1,6 +1,6 @@
-{ ... }: {
-  services.openssh = {
-    enable = true;
-    permitRootLogin = "yes";
-  };
-}
\ No newline at end of file
+{ ... }: {
+  services.openssh = {
+    enable = true;
+    permitRootLogin = "yes";
+  };
+}