{ lib, config, ... }:
{
  options = {
    userPasswords.secrets.consumer = lib.mkOption {
      type = config.contracts.secrets.provider;
    };
  };
  config = {
    users.users.root.passwordFile = config.userPasswords.secrets.consumer.output.path;
  };
}