{
  config,
  lib,
  ...
}: let
  cfg = config.roles.docker;
in {
  options.roles.docker = {
    enable = lib.mkEnableOption "Docker";
    enableNvidia = lib.mkEnableOption "Docker NVIDIA GPU support";
  };

  config = lib.mkIf cfg.enable {
    virtualisation.docker = {
      enable = true;
      enableNvidia = cfg.enableNvidia;
    };

    # FIXME: make configurable
    roles.base.primaryUser.extraGroups = ["docker"];
  };
}