{
  flake,
  pkgs,
  lib,
  config,
  ...
}:
{
  options.pub-solar-os.authentication =
    let
      inherit (lib) mkOption types;
    in
    {
      root.initialHashedPassword = mkOption {
        description = "Hashed password of the root account";
        type = types.str;
        default = "$y$j9T$bIN6GjQkmPMllOcQsq52K0$q0Z5B5.KW/uxXK9fItB8H6HO79RYAcI/ZZdB0Djke32";
      };

      robot.username = mkOption {
        description = "username for the robot user";
        type = types.str;
        default = "hakkonaut";
      };

      robot.sshPubKeys = mkOption {
        description = "SSH Keys to use for the robot user";
        type = types.listOf types.str;
        default = flake.self.logins.robots.sshPubKeys;
      };
    };

  config = {
    users.users =
      (lib.attrsets.foldlAttrs (
        acc: name: value:
        acc
        // {
          ${name} = {
            name = name;
            group = name;
            extraGroups = [
              "wheel"
              "docker"
            ];
            isNormalUser = true;
            openssh.authorizedKeys.keys = lib.attrsets.attrValues value.sshPubKeys;
          };
        }
      ) { } flake.self.logins.admins)
      // {
        # TODO: Remove when we stop locking ourselves out.
        root.openssh.authorizedKeys.keys = config.pub-solar-os.authentication.sshPubKeys;
        root.initialHashedPassword = config.pub-solar-os.authentication.root.initialHashedPassword;

        ${config.pub-solar-os.authentication.robot.username} = {
          description = "CI and automation user";
          home = "/home/${config.pub-solar-os.authentication.robot.username}";
          createHome = true;
          useDefaultShell = true;
          uid = 998;
          group = "${config.pub-solar-os.authentication.robot.username}";
          isSystemUser = true;
          openssh.authorizedKeys.keys = config.pub-solar-os.authentication.robot.sshPubKeys;
        };
      };

    users.groups =
      (lib.attrsets.foldlAttrs (
        acc: name: value:
        acc // { "${name}" = { }; }
      ) { } flake.self.logins.admins)
      // {
        ${config.pub-solar-os.authentication.robot.username} = { };
      };

    security.sudo.wheelNeedsPassword = false;
  };
}