{ appConfig, lib, ... }: {
  name = "authelia";
  endOfLife = null;
  options = {
    domain = lib.mkOption {
      type = lib.types.str;
    };
    users = lib.mkOption {
      type = lib.types.attrsOf (lib.types.submodule {
        options.username = lib.mkOption {
          type = lib.types.nullOr lib.types.str;
          default = null;
        };
        options.passwordFile = lib.mkOption {
          type = lib.types.nullOr lib.types.str;
          default = null;
        };
      });
    };
    jwtSecret = lib.mkOption {
      type = lib.types.str;
      default = "system-secrets/${appConfig.appId}/jwtSecret";
    };
    storageEncryptionKey = lib.mkOption {
      type = lib.types.str;
      default = "system-secrets/${appConfig.appId}/storageEncryptionKey";
    };
    sessionSecret = lib.mkOption {
      type = lib.types.str;
      default = "system-secrets/${appConfig.appId}/sessionSecret";
    };
  };
}