diff --git a/flake.nix b/flake.nix
index 2bd98e6..625c7b7 100644
--- a/flake.nix
+++ b/flake.nix
@@ -22,7 +22,7 @@
     };
   };
 
-  outputs = { nixpkgs, flake-utils, agenix, home-manager, webcord, ... }@inputs:
+  outputs = { nixpkgs, flake-utils, agenix, home-manager, webcord, ... }:
 
     # Provide colmena
     (flake-utils.lib.eachDefaultSystem (system:
@@ -33,7 +33,7 @@
             pkgs.colmena
             pkgs.nixfmt
             pkgs.git
-            inputs.agenix.packages.${system}.ragenix
+            agenix.packages.${system}.ragenix
           ];
         };
       })) // {
diff --git a/hosts/hydrogen/configuration.nix b/hosts/hydrogen/configuration.nix
index 98e7b90..b1e8f09 100644
--- a/hosts/hydrogen/configuration.nix
+++ b/hosts/hydrogen/configuration.nix
@@ -144,12 +144,22 @@
 
   environment.systemPackages = with pkgs; [ htop ];
 
+  age.secrets.gitea = {
+    file = ../../secrets/gitea.age;
+    owner = "gitea";
+    group = "gitea";
+  };
+  age.identityPaths = [ "/root/.ssh/id_ed25519" ];
+
   services.gitea = {
     enable = true;
     domain = "git.fainsin.bzh";
     rootUrl = "https://git.fainsin.bzh";
     lfs.enable = true;
-    database.type = "postgres";
+    database = {
+      type = "postgres";
+      passwordFile = config.age.secrets.gitea.path;
+    };
     settings = {
       service = {
         "DEFAULT_KEEP_EMAIL_PRIVATE" = true;