{
  config,
  pkgs,
  lib,
  ...
}:
let
  cfg = config.depot.users;

  inherit (builtins)
    attrValues
    ;

  inherit (lib) mkIf mkEnableOption;

  keys = {
    t480 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEOw8YEbHsKy38JHp9W1wcxxZgWCDgnabOXccZUN5ddd";
    t1 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP7T2uWJFUu8aFZZgQusGKyEMocb2pKbHLDad2eIJus9";
  };
in
{
  options.depot.users.kle.enable = mkEnableOption "kle user";

  config.users.users.kle = mkIf cfg.kle.enable {
    initialHashedPassword = "$6$R4dDhaftX.vapGMd$.An36hlp3DXfkIC7bPZ0MDPo6Zvpk8JRrhy2LES.lZZj6JDa74oJkcMW3DCsIySvLJxOPXSShos0TpgJ/w0fH/";
    isNormalUser = true;
    shell = pkgs.fish;
    home = "/persist/usr/kle";
    createHome = true;
    extraGroups = [
      "wheel"
      "users"
      "networkmanager"
      "video"
      "kvm"
      "i2c"
      "dialout"
    ];
    packages = with pkgs; [
      btop
      curl
      fzf
      guvcview
      jq
      jujutsu
      lynx
      neovim
      ripgrep
      rsync
      sshfs
      tree
      watchman
      zip

      # passwords
      pinentry-qt
      rbw

      depot.perf-flamegraph

      # email
      isync
      msmtp
      mu

      # nix debugging
      nil
      nix-search-cli
      nixfmt
    ];

    openssh.authorizedKeys.keys = attrValues keys;
  };
}