A new start

modules/nixos/home/default.nix

@@ -0,0 +1,32 @@
+{ options, config, pkgs, lib, inputs, ... }:
+
+with lib;
+with lib.metacfg;
+let cfg = config.metacfg.home;
+in
+{
+  options.metacfg.home = with types; {
+    file = mkOpt attrs { }
+      (mdDoc "A set of files to be managed by home-manager's `home.file`.");
+    configFile = mkOpt attrs { }
+      (mdDoc "A set of files to be managed by home-manager's `xdg.configFile`.");
+    extraOptions = mkOpt attrs { } "Options to pass directly to home-manager.";
+  };
+
+  config = {
+    metacfg.home.extraOptions = {
+      home.stateVersion = config.system.stateVersion;
+      home.file = mkAliasDefinitions options.metacfg.home.file;
+      xdg.enable = true;
+      xdg.configFile = mkAliasDefinitions options.metacfg.home.configFile;
+    };
+
+    home-manager = {
+      useUserPackages = true;
+      useGlobalPkgs = true;
+
+      users.${config.metacfg.user.name} =
+        mkAliasDefinitions options.metacfg.home.extraOptions;
+    };
+  };
+}

modules/nixos/nix-ld/default.nix

@@ -0,0 +1,135 @@
+{ options, config, lib, pkgs, ... }:
+
+with lib;
+with lib.metacfg;
+let cfg = config.metacfg.nix-ld;
+in
+{
+  options.metacfg.nix-ld = with types; {
+    enable = mkBoolOpt false "Whether or not to enable nix-ld.";
+  };
+
+  config = mkIf cfg.enable {
+
+    programs.nix-ld.enable = true;
+
+    # Sets up all the libraries to load
+    programs.nix-ld.libraries = with pkgs; [
+      SDL
+      SDL2
+      SDL2_image
+      SDL2_mixer
+      SDL2_ttf
+      SDL_image
+      SDL_mixer
+      SDL_ttf
+      alsa-lib
+      at-spi2-atk
+      at-spi2-core
+      atk
+      bzip2
+      cairo
+      cups
+      curlWithGnuTls
+      dbus
+      dbus-glib
+      desktop-file-utils
+      e2fsprogs
+      expat
+      flac
+      fontconfig
+      freeglut
+      freetype
+      fribidi
+      fuse
+      fuse3
+      gdk-pixbuf
+      glew110
+      glib
+      gmp
+      gst_all_1.gst-plugins-base
+      gst_all_1.gst-plugins-ugly
+      gst_all_1.gstreamer
+      gtk2
+      harfbuzz
+      icu
+      keyutils.lib
+      libGL
+      libGLU
+      libappindicator-gtk2
+      libcaca
+      libcanberra
+      libcap
+      libclang.lib
+      libdbusmenu
+      libdrm
+      libgcrypt
+      libgpg-error
+      libidn
+      libjack2
+      libjpeg
+      libmikmod
+      libogg
+      libpng12
+      libpulseaudio
+      librsvg
+      libsamplerate
+      libsecret
+      libthai
+      libtheora
+      libtiff
+      libudev0-shim
+      libusb1
+      libuuid
+      libvdpau
+      libvorbis
+      libvpx
+      libxcrypt-legacy
+      libxkbcommon
+      libxml2
+      mesa
+      nspr
+      nss
+      openssl
+      p11-kit
+      pango
+      pixman
+      python3
+      speex
+      stdenv.cc.cc
+      tbb
+      udev
+      vulkan-loader
+      wayland
+      xorg.libICE
+      xorg.libSM
+      xorg.libX11
+      xorg.libXScrnSaver
+      xorg.libXcomposite
+      xorg.libXcursor
+      xorg.libXdamage
+      xorg.libXext
+      xorg.libXfixes
+      xorg.libXft
+      xorg.libXi
+      xorg.libXinerama
+      xorg.libXmu
+      xorg.libXrandr
+      xorg.libXrender
+      xorg.libXt
+      xorg.libXtst
+      xorg.libXxf86vm
+      xorg.libpciaccess
+      xorg.libxcb
+      xorg.xcbutil
+      xorg.xcbutilimage
+      xorg.xcbutilkeysyms
+      xorg.xcbutilrenderutil
+      xorg.xcbutilwm
+      xorg.xkeyboardconfig
+      xz
+      zlib
+    ];
+
+  };
+}

modules/nixos/nix/default.nix

@@ -0,0 +1,94 @@
+{ options, config, pkgs, lib, inputs, ... }:
+
+with lib;
+with lib.metacfg;
+let
+  cfg = config.metacfg.nix;
+
+  substituters-submodule = types.submodule ({ name, ... }: {
+    options = with types; {
+      key = mkOpt (nullOr str) null "The trusted public key for this substituter.";
+    };
+  });
+in
+{
+  options.metacfg.nix = with types; {
+    enable = mkBoolOpt false "Whether or not to manage nix configuration.";
+    package = mkOpt package pkgs.nix "Which nix package to use.";
+
+    default-substituter = {
+      url = mkOpt str "https://cache.nixos.org" "The url for the substituter.";
+      key = mkOpt str "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=" "The trusted public key for the substituter.";
+    };
+
+    extra-substituters = mkOpt (attrsOf substituters-submodule) { } "Extra substituters to configure.";
+  };
+
+  config = mkIf cfg.enable {
+    assertions = mapAttrsToList
+      (name: value: {
+        assertion = value.key != null;
+        message = "metacfg.nix.extra-substituters.${name}.key must be set";
+      })
+      cfg.extra-substituters;
+
+    environment.systemPackages = with pkgs; [
+      metacfg.nixos-revision
+      (metacfg.nixos-hosts.override {
+        hosts = inputs.self.nixosConfigurations;
+      })
+      deploy-rs
+      nixfmt
+      nix-index
+      nix-prefetch-git
+      nix-output-monitor
+    ];
+
+    nix =
+      let
+        users = [ "root" config.metacfg.user.name ] ++
+          optional config.services.hydra.enable "hydra";
+        extra-substituters = cfg.extra-substituters // {
+          "https://nixsgx.cachix.org".key = "nixsgx.cachix.org-1:tGi36DlY2joNsIXOlGnSgWW0+E094V6hW0umQRo/KoE=";
+        };
+      in
+      {
+        package = cfg.package;
+
+        settings = {
+          experimental-features = "nix-command flakes";
+          http-connections = 50;
+          warn-dirty = false;
+          log-lines = 50;
+          sandbox = "relaxed";
+          auto-optimise-store = true;
+          trusted-users = users;
+          allowed-users = users;
+
+          substituters =
+            [ cfg.default-substituter.url ]
+              ++
+              (mapAttrsToList (name: value: name) extra-substituters);
+          trusted-public-keys =
+            [ cfg.default-substituter.key ]
+              ++
+              (mapAttrsToList (name: value: value.key) extra-substituters);
+
+        } // (lib.optionalAttrs config.metacfg.tools.direnv.enable {
+          keep-outputs = true;
+          keep-derivations = true;
+        });
+
+        gc = {
+          automatic = true;
+          dates = "weekly";
+          options = "--delete-older-than 30d";
+        };
+
+        # flake-utils-plus
+        generateRegistryFromInputs = true;
+        generateNixPathFromInputs = true;
+        linkInputs = true;
+      };
+  };
+}

modules/nixos/services/base/default.nix

@@ -0,0 +1,159 @@
+{ options
+, config
+, lib
+, pkgs
+, ...
+}:
+with lib;
+with lib.metacfg;
+let
+  cfg = config.metacfg.base;
+  gitconfig = pkgs.writeText "gitconfig" ''
+    [filter "rot8000"]
+        smudge = ${pkgs.metacfg.rot8000}/bin/rot8000
+        clean = ${pkgs.metacfg.rot8000}/bin/rot8000
+  '';
+in
+{
+  options.metacfg.base = with types; {
+    enable = mkBoolOpt false "Whether or not to enable the base config.";
+
+  };
+
+  config = mkIf cfg.enable {
+    # Configure console keymap
+    console.keyMap = lib.mkDefault "us";
+
+    # Select internationalisation properties.
+    i18n.defaultLocale = "en_US.UTF-8";
+    i18n.extraLocaleSettings = {
+      LC_ADDRESS = "de_DE.UTF-8";
+      LC_IDENTIFICATION = "de_DE.UTF-8";
+      LC_MEASUREMENT = "de_DE.UTF-8";
+      LC_MESSAGES = "en_US.UTF-8";
+      LC_MONETARY = "de_DE.UTF-8";
+      LC_NAME = "de_DE.UTF-8";
+      LC_NUMERIC = "de_DE.UTF-8";
+      LC_TELEPHONE = "de_DE.UTF-8";
+      LC_TIME = "de_DE.UTF-8";
+    };
+
+    environment = {
+      sessionVariables = { PATH = "$HOME/bin:$HOME/.cargo/bin"; };
+      systemPackages = with pkgs; [
+        age
+        bash
+        cifs-utils
+        clevis
+        delta
+        efibootmgr
+        git
+        git-crypt
+        git-delete-merged-branches
+        home-manager
+        htop
+        mosh
+        nixpkgs-fmt
+        openssl
+        restic
+        rrsync
+        sbctl
+        sops
+        strace
+        tmux
+        tpm2-pkcs11
+        tpm2-pkcs11.out
+        tpm2-tools
+        vim
+        virt-manager
+        wget
+      ];
+      shells = [ pkgs.fish pkgs.bash ];
+    };
+
+    hardware = {
+      cpu = {
+        amd.updateMicrocode = lib.mkDefault true;
+        intel.updateMicrocode = lib.mkDefault true;
+      };
+      enableRedistributableFirmware = lib.mkDefault true;
+      enableAllFirmware = true;
+      opengl.extraPackages = with pkgs; [ intel-compute-runtime ];
+    };
+
+    programs = {
+      dconf.enable = true;
+      bash = {
+        ## shellInit = ''
+        interactiveShellInit = ''
+          bind '"\e[A": history-search-backward'
+          bind '"\e[B": history-search-forward'
+        '';
+      };
+      starship.enable = true;
+      mosh.enable = true;
+      vim.defaultEditor = true;
+      fish.enable = true;
+    };
+
+    # powerManagement.cpuFreqGovernor = "ondemand";
+
+    services = {
+      dbus.implementation = "broker";
+      dbus.packages = [ pkgs.gcr ];
+      fwupd.enable = true;
+      openssh = {
+        enable = true;
+        settings.PermitRootLogin = "prohibit-password";
+        settings.X11Forwarding = true;
+      };
+    };
+
+    security = {
+      tpm2.enable = lib.mkDefault true;
+      tpm2.abrmd.enable = lib.mkDefault true;
+      sudo = {
+        enable = true;
+        wheelNeedsPassword = false;
+      };
+    };
+
+    time.timeZone = "Europe/Berlin";
+
+    users.users.root.openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMNsmP15vH8BVKo7bdvIiiEjiQboPGcRPqJK0+bH4jKD harald@lenovo.fritz.box"
+      "sk-ecdsa-sha2-nistp256@openssh.com AAAAInNrLWVjZHNhLXNoYTItbmlzdHAyNTZAb3BlbnNzaC5jb20AAAAIbmlzdHAyNTYAAABBBACLgT81iB1iWWVuXq6PdQ5GAAGhaZhSKnveQCvcNnAOZ5WKH80bZShKHyAYzrzbp8IGwLWJcZQ7TqRK+qZdfagAAAAEc3NoOg== harald@hoyer.xyz"
+      "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIDsb/Tr69YN5MQLweWPuJaRGm+h2kOyxfD6sqKEDTIwoAAAABHNzaDo= harald@fedora.fritz.box"
+    ];
+
+    boot = {
+      tmp.cleanOnBoot = true;
+      loader = {
+        systemd-boot.enable = lib.mkDefault true;
+        efi.canTouchEfiVariables = true;
+        timeout = 2;
+      };
+      initrd.systemd.enable = true;
+      kernelPackages = lib.mkOverride 0 pkgs.linuxPackages_latest;
+    };
+
+    system.autoUpgrade = {
+      flags = [
+        "--update-input"
+        "nixpkgs"
+        "--update-input"
+        "unstable"
+        "--no-write-lock-file"
+        "-L"
+      ];
+      flake = "git+https://git.hoyer.xyz/harald/nixcfg";
+    };
+    systemd.services.nixos-upgrade = {
+      path = [ pkgs.metacfg.rot8000 ];
+      environment.GIT_CONFIG_GLOBAL = toString gitconfig;
+    };
+
+    virtualisation.libvirtd.enable = true;
+
+  };
+}

modules/nixos/services/gui/default.nix

@@ -0,0 +1,138 @@
+{ options, config, lib, pkgs, ... }:
+
+with lib;
+with lib.metacfg;
+let cfg = config.metacfg.gui;
+in
+{
+  options.metacfg.gui = with types; {
+    enable = mkBoolOpt false "Whether or not to enable a GUI.";
+  };
+
+  config = mkIf cfg.enable {
+    services = {
+      gnome.tracker-miners.enable = lib.mkForce false;
+
+      flatpak.enable = true;
+
+      pcscd.enable = lib.mkDefault false;
+
+      # Enable CUPS to print documents.
+      printing.enable = true;
+
+      pipewire = {
+        enable = true;
+        alsa.enable = true;
+        alsa.support32Bit = true;
+        pulse.enable = true;
+        # If you want to use JACK applications, uncomment this
+        #jack.enable = true;
+
+        # use the example session manager (no others are packaged yet so this is enabled by default,
+        # no need to redefine it in your config for now)
+        #media-session.enable = true;
+      };
+
+      udev.packages = [
+        pkgs.libu2f-host
+        pkgs.yubikey-personalization
+      ];
+
+      xserver = {
+        layout = lib.mkDefault "de+us";
+        enable = true;
+        displayManager.gdm.enable = true;
+        desktopManager.gnome.enable = true;
+      };
+    };
+    #security.pam.p11.control = "sufficient";
+    #security.pam.p11.control = "required";
+    #security.pam.p11.enable = true;
+    #  services.fprintd.enable = true;
+    #security.pam.yubico.enable = true;
+    #security.pam.yubico.control = "sufficient";
+    #security.pam.yubico.mode = "challenge-response";
+
+    #security.tpm2.pkcs11.enable = true;
+
+    # Enable sound with pipewire.
+    sound.enable = true;
+    hardware.pulseaudio.enable = false;
+
+    security.rtkit.enable = true;
+
+    programs.gnupg.agent = {
+      enable = true;
+      enableSSHSupport = true;
+      enableBrowserSocket = true;
+    };
+
+    environment.systemPackages = with pkgs; [
+      bat
+      cardpeek
+      ccache
+      clang
+      dive
+      file
+      firefox
+      gh
+      git
+      gimp
+      gnome.gnome-software
+      gnomeExtensions.appindicator
+      gnomeExtensions.dash-to-panel
+      gnomeExtensions.hibernate-status-button
+      gnomeExtensions.vitals
+      gnupg
+      go
+      jetbrains-toolbox
+      jq
+      kbfs
+      libu2f-host
+      mosh
+      mosh
+      nixpkgs-fmt
+      opensc
+      pasystray
+      #pcsctools
+      pinentry-gnome
+      pkg-config
+      ripgrep
+      slack
+      spotify
+      statix
+      thunderbird
+      tmux
+      vim
+      wl-clipboard
+      yubikey-personalization
+      yubikey-manager-qt
+      zellij
+      rustup
+    ];
+
+    #----=[ Fonts ]=----#
+    fonts = {
+      enableDefaultPackages = false;
+      packages = with pkgs; [
+        noto-fonts-emoji
+        liberation_ttf
+        freefont_ttf
+        (nerdfonts.override { fonts = [ "FiraCode" "DroidSansMono" "JetBrainsMono" ]; })
+      ];
+
+      fontconfig = {
+        enable = true;
+        defaultFonts = {
+          serif = [ "Liberation" ];
+          sansSerif = [ "Liberation" ];
+          monospace = [ "JetBrainsMono" ];
+          emoji = [ "Noto Color Emoji" ];
+        };
+      };
+    };
+
+    # remote desktop
+    networking.firewall.allowedTCPPorts = [ 3389 ];
+  };
+}

modules/nixos/services/podman/default.nix

@@ -0,0 +1,25 @@
+{ options, config, lib, pkgs, ... }:
+
+with lib;
+with lib.metacfg;
+let cfg = config.metacfg.podman;
+in
+{
+  options.metacfg.podman = with types; {
+    enable = mkBoolOpt false "Whether or not to enable podman.";
+  };
+
+  config = mkIf cfg.enable {
+    virtualisation = {
+      podman = {
+        enable = true;
+
+        # Create a `docker` alias for podman, to use it as a drop-in replacement
+        dockerCompat = lib.mkDefault true;
+
+        # For Nixos version > 22.11
+        defaultNetwork.settings = { dns_enabled = true; };
+      };
+    };
+  };
+}

modules/nixos/services/secureboot/default.nix

@@ -0,0 +1,21 @@
+{ options, config, lib, pkgs, ... }:
+
+with lib;
+with lib.metacfg;
+let cfg = config.metacfg.secureboot;
+in
+{
+  options.metacfg.secureboot = with types; {
+    enable = mkBoolOpt false "Whether or not to enable secureboot.";
+  };
+
+  config = mkIf cfg.enable {
+    boot = {
+      lanzaboote = {
+        enable = true;
+        pkiBundle = "/etc/secureboot";
+      };
+      loader.systemd-boot.enable = lib.mkForce false;
+    };
+  };
+}

modules/nixos/sgx/aesmd_dcap/default.nix

@@ -0,0 +1,30 @@
+{ options, config, lib, pkgs, ... }:
+
+with lib;
+with lib.metacfg;
+let
+  cfg = config.metacfg.aesmd_dcap;
+in
+{
+  options.metacfg.aesmd_dcap = with types; {
+    enable = mkBoolOpt false "Whether or not to enable aesmd in dcap mode.";
+  };
+
+  config = mkIf cfg.enable {
+    metacfg = {
+      nix.extra-substituters = {
+        "https://nixsgx.cachix.org".key = "nixsgx.cachix.org-1:tGi36DlY2joNsIXOlGnSgWW0+E094V6hW0umQRo/KoE=";
+      };
+    };
+    services.aesmd = {
+      enable = true;
+      quoteProviderLibrary = pkgs.nixsgx.sgx-dcap.default_qpl;
+    };
+    systemd.services.aesmd = {
+      environment.LD_LIBRARY_PATH = lib.mkForce (lib.makeLibraryPath [ pkgs.nixsgx.sgx-dcap.default_qpl pkgs.curl.out ]);
+      serviceConfig.BindReadOnlyPaths = [
+        "/etc/sgx_default_qcnl.conf"
+      ];
+    };
+  };
+}

modules/nixos/sgx/pccs/default.nix

@@ -0,0 +1,69 @@
+{ options, config, lib, pkgs, ... }:
+
+with lib;
+with lib.metacfg;
+let
+  cfg = config.metacfg.pccs;
+  cfg_podman = config.metacfg.podman;
+in
+{
+  options.metacfg.pccs = with types; {
+    enable = mkBoolOpt false "Whether or not to enable a SGX-DCAP.";
+    secret = mkOption {
+      type = with types; nullOr path;
+      default = null;
+      example = literalExpression "config.sops.secrets.pccs.path";
+      description = lib.mdDoc "path to the pccs secret file";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.secret != null;
+        message = "path to the pccs secret file is required when pccs is enabled";
+      }
+      {
+        assertion = cfg_podman.enable;
+        message = "podman must be enabled when pccs is enabled";
+      }
+    ];
+
+    metacfg = {
+      nix.extra-substituters = {
+        "https://nixsgx.cachix.org".key = "nixsgx.cachix.org-1:tGi36DlY2joNsIXOlGnSgWW0+E094V6hW0umQRo/KoE=";
+      };
+    };
+
+    virtualisation.oci-containers.backend = "podman";
+    virtualisation.oci-containers.containers = {
+      # podman run --pull=always --name pccs -it --rm -v /dev/log:/dev/log --secret PCCS_CONFIG,type=mount -p 8081:8081 registry.gitlab.com/haraldh/pccs:pccs_1_19
+      pccs = {
+        image = "docker.io/backslashhh/pccs:dcap_1_19";
+        autoStart = true;
+        ports = [ "8081:8081" ];
+        extraOptions = [
+          "--volume=/dev/log:/dev/log"
+          "--secret=PCCS_CONFIG,type=mount"
+        ];
+      };
+    };
+
+    systemd.services.pccs-secret =
+      {
+        description = "Inject pccs secret";
+        wantedBy = [ "multi-user.target" ];
+        before = [ "podman-pccs.service" ];
+
+        serviceConfig = {
+          EnvironmentFile = cfg.secret;
+          ExecStart = ''
+            -${pkgs.podman}/bin/podman secret create --env PCCS_CONFIG PCCS_CONFIG
+          '';
+          RemainAfterExit = true;
+        };
+      };
+
+
+  };
+}

modules/nixos/tools/direnv/default.nix

@@ -0,0 +1,20 @@
+{ options, config, lib, pkgs, ... }:
+
+with lib;
+with lib.metacfg;
+let cfg = config.metacfg.tools.direnv;
+in
+{
+  options.metacfg.tools.direnv = with types; {
+    enable = mkBoolOpt false "Whether or not to enable direnv.";
+  };
+
+  config = mkIf cfg.enable {
+    metacfg.home.extraOptions = {
+      programs.direnv = {
+        enable = true;
+        nix-direnv = enabled;
+      };
+    };
+  };
+}

modules/nixos/tools/git/default.nix

@@ -0,0 +1,61 @@
+{ options, config, pkgs, lib, ... }:
+
+with lib;
+with lib.metacfg;
+let
+  cfg = config.metacfg.tools.git;
+  gpg = config.metacfg.security.gpg;
+  user = config.metacfg.user;
+in
+{
+  options.metacfg.tools.git = with types; {
+    enable = mkBoolOpt false "Whether or not to install and configure git.";
+    userName = mkOpt types.str user.fullName "The name to configure git with.";
+    userEmail = mkOpt types.str user.email "The email to configure git with.";
+    signingKey =
+      mkOpt types.str "9762169A1B35EA68" "The key ID to sign commits with.";
+  };
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = with pkgs; [ git ];
+
+    metacfg.home.extraOptions = {
+      programs.git = {
+        enable = true;
+        inherit (cfg) userName userEmail;
+        lfs = enabled;
+        signing = {
+          key = cfg.signingKey;
+          signByDefault = mkIf gpg.enable true;
+        };
+        extraConfig = {
+          init = { defaultBranch = "main"; };
+          pull = { rebase = true; };
+          push = { autoSetupRemote = true; };
+          core = { whitespace = "trailing-space,space-before-tab"; };
+          safe = {
+            directory = "${user.home}/git";
+          };
+          "credential \"https://github.com\"" = {
+            helper = "!gh auth git-credential";
+          };
+          alias = {
+            co = "checkout";
+            ci = "commit --signoff";
+          };
+          pull.ff = "only";
+          core.pager = "${pkgs.delta}/bin/delta";
+          delta = {
+            features = "decorations";
+            syntax-theme = "DarkNeon";
+            light = "false";
+            navigate = "true";
+          };
+          interactive.diffFilter = "${pkgs.delta}/bin/delta --color-only";
+          merge.conflictStyle = "diff3";
+          diff.colorMoved = "default";
+        };
+      };
+    };
+  };
+}

modules/nixos/user/default.nix

@@ -0,0 +1,104 @@
+{ options
+, config
+, pkgs
+, lib
+, ...
+}:
+with lib;
+with lib.metacfg; let
+  cfg = config.metacfg.user;
+  defaultIconFileName = "profile.jpg";
+  defaultIcon = pkgs.stdenvNoCC.mkDerivation {
+    name = "default-icon";
+    src = ./. + "/${defaultIconFileName}";
+
+    dontUnpack = true;
+
+    installPhase = ''
+      cp $src $out
+    '';
+
+    passthru = { fileName = defaultIconFileName; };
+  };
+  propagatedIcon =
+    pkgs.runCommandNoCC "propagated-icon"
+      { passthru = { fileName = cfg.icon.fileName; }; }
+      ''
+        local target="$out/share/metacfg-icons/user/${cfg.name}"
+        mkdir -p "$target"
+
+        cp ${cfg.icon} "$target/${cfg.icon.fileName}"
+      '';
+in
+{
+  options.metacfg.user = with types; {
+    name = mkOpt str "harald" "The name to use for the user account.";
+    fullName = mkOpt str "Harald Hoyer" "The full name of the user.";
+    email = mkOpt str "harald@hoyer.xyz" "The email of the user.";
+    initialPassword =
+      mkOpt str "password"
+        "The initial password to use when the user is first created.";
+    icon =
+      mkOpt (nullOr package) defaultIcon
+        "The profile picture to use for the user.";
+    prompt-init = mkBoolOpt true "Whether or not to show an initial message when opening a new shell.";
+    extraGroups = mkOpt (listOf str) [ ] "Groups for the user to be assigned.";
+    sshKeys = mkOpt (listOf str) [
+      "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIDsb/Tr69YN5MQLweWPuJaRGm+h2kOyxfD6sqKEDTIwoAAAABHNzaDo= harald@fedora.fritz.box"
+      "sk-ecdsa-sha2-nistp256@openssh.com AAAAInNrLWVjZHNhLXNoYTItbmlzdHAyNTZAb3BlbnNzaC5jb20AAAAIbmlzdHAyNTYAAABBBACLgT81iB1iWWVuXq6PdQ5GAAGhaZhSKnveQCvcNnAOZ5WKH80bZShKHyAYzrzbp8IGwLWJcZQ7TqRK+qZdfagAAAAEc3NoOg== harald@hoyer.xyz"
+      "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBAYbUTKpy4QR3s944/hjJ1UK05asFEs/SmWeUbtS0cdA660sT4xHnRfals73FicOoz+uIucJCwn/SCM804j+wtM="
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMNsmP15vH8BVKo7bdvIiiEjiQboPGcRPqJK0+bH4jKD harald@lenovo.fritz.box"
+    ] "ssh keys";
+    extraOptions =
+      mkOpt attrs { }
+        (mdDoc "Extra options passed to `users.users.<name>`.");
+  };
+
+  config = {
+    environment.systemPackages = with pkgs; [
+    ];
+
+    metacfg.home = {
+      file = {
+        "Desktop/.keep".text = "";
+        "Documents/.keep".text = "";
+        "Downloads/.keep".text = "";
+        "Music/.keep".text = "";
+        "Pictures/.keep".text = "";
+        "Videos/.keep".text = "";
+        "work/.keep".text = "";
+        ".face".source = cfg.icon;
+        "Pictures/${
+          cfg.icon.fileName or (builtins.baseNameOf cfg.icon)
+        }".source =
+          cfg.icon;
+      };
+      extraOptions.programs.bash.initExtra = ''
+        [[ $WANT_BASH ]] || ${pkgs.fish}/bin/fish -l
+      '';
+    };
+
+    users.users.${cfg.name} =
+      {
+        isNormalUser = true;
+
+        # inherit (cfg) name initialPassword;
+
+        openssh.authorizedKeys.keys = cfg.sshKeys;
+        home = "/home/${cfg.name}";
+        group = "users";
+
+        shell = pkgs.bash;
+
+        # Arbitrary user ID to use for the user. Since I only
+        # have a single user on my machines this won't ever collide.
+        # However, if you add multiple users you'll need to change this
+        # so each user has their own unique uid (or leave it out for the
+        # system to select).
+        uid = 1000;
+
+        extraGroups = [ ] ++ cfg.extraGroups;
+      }
+      // cfg.extraOptions;
+  };
+}