{ config
, pkgs
, lib
, ...
}:

let
  cfg = config.my.users.petere;
in
{
  options.my.users.petere = {
    enable = lib.mkOption {
      type = lib.types.bool;
      default = true;
      description = "Whether to create the petere admin user.";
    };

    description = lib.mkOption {
      type = lib.types.nullOr lib.types.str;
      default = null;
      description = "Optional GECOS description for petere.";
    };

    hashedPasswordFile = lib.mkOption {
      type = lib.types.nullOr lib.types.str;
      default = null;
      description = "Path to the hashed password file, or null for SSH-key-only access.";
    };

    subUidStart = lib.mkOption {
      type = lib.types.nullOr lib.types.int;
      default = null;
      description = "Start UID for petere's rootless subuid range, or null to disable.";
    };

    subGidStart = lib.mkOption {
      type = lib.types.nullOr lib.types.int;
      default = null;
      description = "Start GID for petere's rootless subgid range, or null to disable.";
    };
  };

  config = lib.mkIf cfg.enable {
    users.users.petere = {
      isNormalUser = true;
      shell = pkgs.zsh;
      extraGroups = [ "wheel" ];
      description = lib.mkIf (cfg.description != null) cfg.description;
      hashedPasswordFile = lib.mkIf (cfg.hashedPasswordFile != null) cfg.hashedPasswordFile;
      openssh.authorizedKeys.keys = [
        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJiCtkYDBfieK3i4TbVomeyXa185yCFZUvrbMamR4bqs petere@x1carbon"
      ];
      subUidRanges = lib.mkIf (cfg.subUidStart != null) [
        {
          startUid = cfg.subUidStart;
          count = 65536;
        }
      ];
      subGidRanges = lib.mkIf (cfg.subGidStart != null) [
        {
          startGid = cfg.subGidStart;
          count = 65536;
        }
      ];
    };
  };
}