{ ... }:
{
  systemd.tmpfiles.rules = [
    "d /private 0750 root root -"
    "z /private/AT\x20Protocol 0700 root root -"
    "z /private/cloudflared 0700 root root -"
    "z /private/cloudflared.pem 0600 root root -"
    "z /private/wafrn 0700 root root -"
    "z /private/tangled.env 0600 root root -"
    "z /private/vaultwarden 0700 root root -"
    "d /private/zipline 0700 root root -"
    "z /protected 0700 root root -"
  ];
}