No Nix derivations under //ops/secrets