{
  config,
  lib,
  ...
}: let
  cfg = config.roles.unfree;
in {
  options.roles.unfree = {
    allow = lib.mkOption {
      type = lib.types.listOf lib.types.str;
      default = [];
    };
  };

  config = {
    nixpkgs.config.allowUnfreePredicate = pkg:
      builtins.elem (lib.getName pkg) cfg.allow;
  };
}