{ appConfig, config, lib, ... }:
{
  password-credentials = lib.concatMapAttrs
    (name: attrs: lib.optionalAttrs (attrs.passwordFile != null) {
      ${name} = { inherit (attrs) username passwordFile; };
    })
    # TODO appConfig should come from config to have been fully evaluated
    config.fysiweb-apps.${appConfig.owner}.${appConfig.appName}.${appConfig.appInstanceName}.users;
  ssh-credentials = lib.concatMapAttrs
    (name: attrs: lib.optionalAttrs (attrs.publicKeyFile != null) {
      ${name} = { inherit (attrs) publicKeyFile; };
    })
    appConfig.users;
}