{ appConfig, lib, ... }: {
  description = "static-users";
  endOfLife = null;
  options.users = lib.mkOption {
    type = lib.types.attrsOf (lib.types.submodule ({ name, ... }: {
      options.passwordFile = lib.mkOption {
        type = lib.types.nullOr lib.types.str;
        default = "system-secrets/${appConfig.appId}/${appConfig.users.${name}.username}.password";
      };
      options.publicKeyFiles = lib.mkOption {
        type = lib.types.listOf lib.types.path;
        default = [ ];
      };
      options.username = lib.mkOption {
        type = lib.types.str;
        default = name;
      };
    }));
    default = { };
  };
}