{
  config,
  lib,
  ...
}: let
  cfg = config.roles.base;
in {
  options.roles.base = {
    root = lib.mkOption {
      type = lib.types.submodule {
        options = {
          hashedPasswordFile = lib.mkOption {
            type = lib.types.path;
          };
        };
      };
    };
    primaryUser = lib.mkOption {
      type = lib.types.submodule {
        options = {
          username = lib.mkOption {
            type = lib.types.str;
          };
          isWheel = lib.mkEnableOption "admin permissions";
          extraGroups = lib.mkOption {
            type = lib.types.listOf lib.types.str;
            default = [];
          };
          hashedPasswordFile = lib.mkOption {
            type = lib.types.path;
          };
        };
      };
    };
  };

  imports = [
    (lib.mkAliasOptionModule ["hm"] [
      "home-manager"
      "users"
      cfg.primaryUser.username
    ])
  ];

  config = let
    homeDirectory = "/home/${cfg.primaryUser.username}";
  in {
    users.users.root.hashedPasswordFile = cfg.root.hashedPasswordFile;
    users.users.${cfg.primaryUser.username} = {
      isNormalUser = true;
      extraGroups = cfg.primaryUser.extraGroups ++ lib.optional cfg.primaryUser.isWheel "wheel";
      home = homeDirectory;
      hashedPasswordFile = cfg.primaryUser.hashedPasswordFile;
    };
    home-manager = {
      useUserPackages = true;
      useGlobalPkgs = true;
    };
    hm.home = {
      inherit (cfg.primaryUser) username;
      inherit homeDirectory;
      stateVersion = config.system.stateVersion;
    };
  };
}