{ pkgs, config, ... }:
{
  age.secrets.apr-password.file = ../../secrets/apr-password.age;
  age.secrets.root-password.file = ../../secrets/root-password.age;

  users = {
    mutableUsers = false;

    users = {
      apr = {
        hashedPasswordFile = config.age.secrets.apr-password.path;
        isNormalUser = true;
        extraGroups = [
          "wheel"
          "docker"
          "networkmanager"
          "adbusers"
          "plugdev"
        ];

        openssh.authorizedKeys.keys = [
          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGDXt8vkpi9jOp9dCjoS8u0dC4fDdgb73w8z7VNI42FB did:web:vt3e.cat"
        ];

        shell = pkgs.fish;
      };
      root = {
        hashedPasswordFile = config.age.secrets.root-password.path;
        openssh.authorizedKeys.keys = [
          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGDXt8vkpi9jOp9dCjoS8u0dC4fDdgb73w8z7VNI42FB did:web:vt3e.cat"
        ];
      };
    };
  };
}