{ config, lib, ... }:
let
  userSubmodule = lib.types.submodule {
    options = {
      name = lib.mkOption {
        type = lib.types.str;
        description = ''
          full name
        '';
      };
      username = lib.mkOption {
        type = lib.types.str;
        description = ''
          user account name
        '';
      };
      email = lib.mkOption { type = lib.types.str; };
      sshKeys = lib.mkOption {
        type = lib.types.listOf lib.types.str;
        description = ''
          SSH public keys
        '';
      };
    };
  };
  usersSubmodule = lib.types.submodule {
    options = {
      users = lib.mkOption { type = lib.types.attrsOf userSubmodule; };
      me = lib.mkOption {
        type = lib.types.str;
        description = ''
          The name of the user that represents me.

          Admin user in all contexts.

          Should be a key into the `users` attribute set.
        '';
      };
      me' = lib.mkOption {
        type = userSubmodule;
        description = ''
          The rest of the user data for `me`.
        '';
        readOnly = true;
      };
    };
  };
in
{
  # TODO: can we hack in an assertion that `me` is a key in `users`?
  options.users = lib.mkOption { type = usersSubmodule; };
  config.users = (import ./config.nix) // {
    me' = lib.mkDefault config.users.users.${config.users.me};
  };
}