{config, ...}: {
  sops.secrets.rootPwd.neededForUsers = true;
  sops.secrets.skyePwd.neededForUsers = true;

  # TODO: role...
  services.flatpak.enable = true;
  environment.persistence."/persist" = {
    directories = [
      "/var/lib/flatpak"
    ];
  };

  roles.base = {
    root = {
      hashedPasswordFile = config.sops.secrets.rootPwd.path;
    };
    primaryUser = {
      username = "skye";
      isWheel = true;
      hashedPasswordFile = config.sops.secrets.skyePwd.path;
    };
  };

  roles.tailscale = {
    enable = true;
    enableSSH = true;
  };

  roles.audio.enable = true;

  roles.git = {
    enable = true;
    enableLazygit = true;
    email = "jonni@liljamo.com";
    name = "Jonni Liljamo";
    gitExtraConfig = ''
      [sendemail]
          smtpserver = "smtp.migadu.com"
          smtpuser = "jonni@liljamo.com"
          smtpencryption = "ssl"
          smtpserverport = 465
    '';
  };

  roles.shell.enable = true;
  roles.zellij.enable = true;
  roles.kitty.enable = true;

  roles.graphics = {
    enable = true;
    nvidia.enable = true;
  };
  roles.plasma.enable = true;

  roles.gaming = {
    enable = true;
    lutris.enable = true;
    steam.enable = true;
  };
}