{ config, lib, pkgs, ... }:
{
  users.mutableUsers = false;

  users.users.phoenix = {
    isNormalUser = true;
    description = "Phoenix";
    extraGroups = [ "wheel" "networkmanager" "podman" ];
    shell = pkgs.bash;
    home = "/home/phoenix";
    createHome = true;
    useDefaultShell = true;
  };

  users.users.deploy = {
    isNormalUser = true;
    extraGroups = [ "wheel" "networkmanager" "podman" ];
    home = "/home/deploy";
  };

  users.users.containers = {
    isSystemUser = true;
    group = "containers";
    extraGroups = [ "podman" ];
    home = "/var/lib/containers";
    createHome = true;
    subUidRanges = [{ startUid = 100000; count = 65536; }];
    subGidRanges = [{ startGid = 100000; count = 65536; }];
    linger = true;
  };
  users.groups.containers = {};

  security.sudo.extraRules = [
    {
      users = [ "phoenix" "deploy" ];
      commands = [
        {
          command = "ALL";
          options = [ "NOPASSWD" ];
        }
      ];
    }
  ];

  nix.settings.trusted-users = [ "root" "@wheel" ];
}