{
  pkgs,
  lib,
  config,
  inputs,
  ...
}: let
  cfg = config.users.custom.deck;
in {
  imports = [
    ../modules/emulationstation-de.nix
  ];

  options.users.custom.deck = with lib; {
    enable = mkEnableOption "user 'deck' on this machine";
  };

  config = lib.mkIf cfg.enable {
    users.users.deck = {
      description = "Deck Mc. Deckster";
      hashedPassword = "$6$zqEC2iJJ98Ne$lRERO30msyjJm7oJCqRD/xj3NIm4De37gD.VUzfg7aceosE/6S6eNAaruIakgUtSC970MHRPoNlCEy1RoFuyh.";
      isNormalUser = true;
      extraGroups = [
        "wheel"
        "networkmanager"
        "video"
        "render"
        "lp"
        "kvm"
        "libvirtd"
        "corectrl"
        "input"
        config.users.groups.keys.name
      ];
      # Yes, use the best, please
      shell = pkgs.fish;
      # Allow my yubikey everywhere
      openssh.authorizedKeys.keyFiles = [../secrets/pub/yubikey.pub];
    };

    # include the sd card, if any is inserted
    fileSystems = {
      "/home/deck/sdcard" = {
        device = "/dev/mmcblk0p1";
        fsType = "ext4";
        options = [
          "nofail"
        ];
      };
    };

    home-manager.users.deck.imports = [../users/deck/default.nix inputs.hyprland.homeManagerModules.default];
    programs.fish.enable = true;

    services.flatpak.enable = true;
    programs.emulationstation-de = {
      enable = true;
      nintendo.enable = true;
    };

    sops.secrets = let
      sopsFile = ../secrets/users/deck/secrets.yaml;
      owner = "deck";
      mode = "0400";
    in {
      restic-backup-deck = {
        inherit sopsFile owner mode;
        key = "restic-backup";
      };
    };
  };
}