diff --git a/secrets.nix.example b/secrets.nix.example
new file mode 100644
index 0000000..efb3c93
--- /dev/null
+++ b/secrets.nix.example
@@ -0,0 +1,18 @@
+{
+  iptables = ''
+    # vpn with default interface name (tun/tap)
+    iptables -A OUTPUT -d 192.0.2.15 -j ACCEPT
+
+    # vpn with non-default interface name
+    iptables -A OUTPUT -d 192.0.2.67 -j ACCEPT
+    iptables -A OUTPUT -o cute-vpn -j ACCEPT
+  '';
+
+  vpn-config = "config /var/vpn/changeme.ovpn";
+  vpn-username = "changeme";
+  vpn-password = "changeme";
+
+  # for redshift
+  latitude = "42.42";
+  longitude = "42.42";
+}