{
  pkgs,
  lib,
  config,
  ...
}: let
  cfg = config.users.custom.malte;
in {
  options.users.custom.malte = with lib; {
    enable = mkEnableOption "Enable user 'malte' on this machine";
  };

  config = lib.mkIf cfg.enable {
    users.users.malte = {
      description = "Malte Tammena";
      hashedPassword = "$6$zqEC2iJJ98Ne$lRERO30msyjJm7oJCqRD/xj3NIm4De37gD.VUzfg7aceosE/6S6eNAaruIakgUtSC970MHRPoNlCEy1RoFuyh.";
      isNormalUser = true;
      extraGroups = [
        "wheel"
        "networkmanager"
        "video"
        "lp"
        "kvm"
        "libvirtd"
        "podman"
        "corectrl"
        "scanner"
        "input"
        config.users.groups.keys.name
      ];
      # Yes, use the best, please
      shell = pkgs.fish;
    };

    home-manager.users.malte.imports = [../users/malte/home.nix];
    programs.fish.enable = true;

    sops.secrets = {
      "restic-backup-malte" = {
        sopsFile = ../secrets/users/malte/secrets.yaml;
        owner = "malte";
        mode = "0400";
        key = "restic-backup";
      };
      "radicale-password" = {
        sopsFile = ../secrets/users/malte/secrets.yaml;
        owner = "malte";
        mode = "0400";
      };
    };
  };
}