diff --git a/legacy/dotfiles/system/secrets/disk-password b/secrets/desktop/disk-password
similarity index 100%
rename from legacy/dotfiles/system/secrets/disk-password
rename to secrets/desktop/disk-password
diff --git a/legacy/dotfiles/system/secrets/nix-cache-netrc b/secrets/desktop/nix-cache-netrc
similarity index 100%
rename from legacy/dotfiles/system/secrets/nix-cache-netrc
rename to secrets/desktop/nix-cache-netrc
diff --git a/legacy/dotfiles/system/secrets/password-hash b/secrets/desktop/password-hash
similarity index 100%
rename from legacy/dotfiles/system/secrets/password-hash
rename to secrets/desktop/password-hash
diff --git a/legacy/dotfiles/system/secrets/secureboot.tar b/secrets/desktop/secureboot.tar
similarity index 100%
rename from legacy/dotfiles/system/secrets/secureboot.tar
rename to secrets/desktop/secureboot.tar
diff --git a/legacy/dotfiles/system/secrets/wifi-passwords.nix b/secrets/desktop/wifi-passwords.nix
similarity index 100%
rename from legacy/dotfiles/system/secrets/wifi-passwords.nix
rename to secrets/desktop/wifi-passwords.nix
diff --git a/legacy/dotfiles/home-manager/secrets/llama_cpp_api_key b/secrets/home/llama_cpp_api_key
similarity index 100%
rename from legacy/dotfiles/home-manager/secrets/llama_cpp_api_key
rename to secrets/home/llama_cpp_api_key
diff --git a/legacy/dotfiles/home-manager/secrets/openrouter_api_key b/secrets/home/openrouter_api_key
similarity index 100%
rename from legacy/dotfiles/home-manager/secrets/openrouter_api_key
rename to secrets/home/openrouter_api_key
diff --git a/legacy/dotfiles/home-manager/secrets/steam-user-id b/secrets/home/steam-user-id
similarity index 100%
rename from legacy/dotfiles/home-manager/secrets/steam-user-id
rename to secrets/home/steam-user-id
diff --git a/legacy/server-config/secrets/caddy_auth.age b/secrets/server/caddy_auth.age
similarity index 100%
rename from legacy/server-config/secrets/caddy_auth.age
rename to secrets/server/caddy_auth.age
diff --git a/legacy/server-config/secrets/ci-deploy-key.age b/secrets/server/ci-deploy-key.age
similarity index 100%
rename from legacy/server-config/secrets/ci-deploy-key.age
rename to secrets/server/ci-deploy-key.age
diff --git a/legacy/server-config/secrets/coturn-auth-secret.age b/secrets/server/coturn-auth-secret.age
similarity index 100%
rename from legacy/server-config/secrets/coturn-auth-secret.age
rename to secrets/server/coturn-auth-secret.age
diff --git a/legacy/server-config/secrets/ddns-updater-config.age b/secrets/server/ddns-updater-config.age
similarity index 100%
rename from legacy/server-config/secrets/ddns-updater-config.age
rename to secrets/server/ddns-updater-config.age
diff --git a/legacy/server-config/secrets/firefox-syncserver-env.age b/secrets/server/firefox-syncserver-env.age
similarity index 100%
rename from legacy/server-config/secrets/firefox-syncserver-env.age
rename to secrets/server/firefox-syncserver-env.age
diff --git a/legacy/server-config/secrets/git-crypt-key-dotfiles.age b/secrets/server/git-crypt-key-dotfiles.age
similarity index 100%
rename from legacy/server-config/secrets/git-crypt-key-dotfiles.age
rename to secrets/server/git-crypt-key-dotfiles.age
diff --git a/legacy/server-config/secrets/git-crypt-key-server-config.age b/secrets/server/git-crypt-key-server-config.age
similarity index 100%
rename from legacy/server-config/secrets/git-crypt-key-server-config.age
rename to secrets/server/git-crypt-key-server-config.age
diff --git a/legacy/server-config/secrets/gitea-runner-token.age b/secrets/server/gitea-runner-token.age
similarity index 100%
rename from legacy/server-config/secrets/gitea-runner-token.age
rename to secrets/server/gitea-runner-token.age
diff --git a/legacy/server-config/secrets/harmonia-sign-key.age b/secrets/server/harmonia-sign-key.age
similarity index 100%
rename from legacy/server-config/secrets/harmonia-sign-key.age
rename to secrets/server/harmonia-sign-key.age
diff --git a/legacy/server-config/secrets/hashedPass.age b/secrets/server/hashedPass.age
similarity index 100%
rename from legacy/server-config/secrets/hashedPass.age
rename to secrets/server/hashedPass.age
diff --git a/legacy/server-config/secrets/jellyfin-api-key.age b/secrets/server/jellyfin-api-key.age
similarity index 100%
rename from legacy/server-config/secrets/jellyfin-api-key.age
rename to secrets/server/jellyfin-api-key.age
diff --git a/legacy/server-config/secrets/livekit_keys b/secrets/server/livekit_keys
similarity index 100%
rename from legacy/server-config/secrets/livekit_keys
rename to secrets/server/livekit_keys
diff --git a/legacy/server-config/secrets/llama-cpp-api-key.age b/secrets/server/llama-cpp-api-key.age
similarity index 100%
rename from legacy/server-config/secrets/llama-cpp-api-key.age
rename to secrets/server/llama-cpp-api-key.age
diff --git a/legacy/server-config/secrets/matrix-reg-token.age b/secrets/server/matrix-reg-token.age
similarity index 100%
rename from legacy/server-config/secrets/matrix-reg-token.age
rename to secrets/server/matrix-reg-token.age
diff --git a/legacy/server-config/secrets/minecraft-whitelist.nix b/secrets/server/minecraft-whitelist.nix
similarity index 100%
rename from legacy/server-config/secrets/minecraft-whitelist.nix
rename to secrets/server/minecraft-whitelist.nix
diff --git a/legacy/server-config/secrets/mollysocket-env.age b/secrets/server/mollysocket-env.age
similarity index 100%
rename from legacy/server-config/secrets/mollysocket-env.age
rename to secrets/server/mollysocket-env.age
diff --git a/legacy/server-config/secrets/murmur-password-env.age b/secrets/server/murmur-password-env.age
similarity index 100%
rename from legacy/server-config/secrets/murmur-password-env.age
rename to secrets/server/murmur-password-env.age
diff --git a/legacy/server-config/secrets/nix-cache-auth.age b/secrets/server/nix-cache-auth.age
similarity index 100%
rename from legacy/server-config/secrets/nix-cache-auth.age
rename to secrets/server/nix-cache-auth.age
diff --git a/legacy/server-config/secrets/njalla-api-token-env.age b/secrets/server/njalla-api-token-env.age
similarity index 100%
rename from legacy/server-config/secrets/njalla-api-token-env.age
rename to secrets/server/njalla-api-token-env.age
diff --git a/legacy/server-config/secrets/ntfy-alerts-token.age b/secrets/server/ntfy-alerts-token.age
similarity index 100%
rename from legacy/server-config/secrets/ntfy-alerts-token.age
rename to secrets/server/ntfy-alerts-token.age
diff --git a/legacy/server-config/secrets/ntfy-alerts-topic.age b/secrets/server/ntfy-alerts-topic.age
similarity index 100%
rename from legacy/server-config/secrets/ntfy-alerts-topic.age
rename to secrets/server/ntfy-alerts-topic.age
diff --git a/legacy/server-config/secrets/persistent.tar b/secrets/server/persistent.tar
similarity index 100%
rename from legacy/server-config/secrets/persistent.tar
rename to secrets/server/persistent.tar
diff --git a/legacy/server-config/secrets/secureboot.tar.age b/secrets/server/secureboot.tar.age
similarity index 100%
rename from legacy/server-config/secrets/secureboot.tar.age
rename to secrets/server/secureboot.tar.age
diff --git a/legacy/server-config/secrets/slskd_env.age b/secrets/server/slskd_env.age
similarity index 100%
rename from legacy/server-config/secrets/slskd_env.age
rename to secrets/server/slskd_env.age
diff --git a/legacy/server-config/secrets/wg0.conf.age b/secrets/server/wg0.conf.age
similarity index 100%
rename from legacy/server-config/secrets/wg0.conf.age
rename to secrets/server/wg0.conf.age
diff --git a/legacy/server-config/secrets/zfs-key.age b/secrets/server/zfs-key.age
similarity index 100%
rename from legacy/server-config/secrets/zfs-key.age
rename to secrets/server/zfs-key.age
diff --git a/legacy/server-config/usb-secrets/setup-usb.sh b/secrets/usb-secrets/setup-usb.sh
similarity index 100%
rename from legacy/server-config/usb-secrets/setup-usb.sh
rename to secrets/usb-secrets/setup-usb.sh
diff --git a/legacy/server-config/usb-secrets/usb-secrets-key b/secrets/usb-secrets/usb-secrets-key
similarity index 100%
rename from legacy/server-config/usb-secrets/usb-secrets-key
rename to secrets/usb-secrets/usb-secrets-key