{
  config,
  lib,
  machine,
  ...
}: {
  users.users =
    builtins.mapAttrs
    (name: value: lib.mkIf (builtins.elem name machine.users) value)
    {
      "andromeda" = {
        isNormalUser = true;
        description = "andromeda";
        hashedPasswordFile = builtins.toString config.age.secrets.andromeda-pw.path;
        extraGroups = [
          "networkmanager" # network configuration
          "wheel" # serial
          "dialout" # access to serial ports
        ];
      };
    };
  environment.persistence."/persist".users = lib.mkIf config.environment.persistence."/persist".enable (
    builtins.mapAttrs
    (name: value: lib.mkIf (builtins.elem name machine.users) value)
    {
      "andromeda" = {
        directories = [
          ".backups"
          ".gnupg"
          ".local/share/AAAAXY"
          ".local/share/Anki2"
          ".local/share/chat.fluffy.fluffychat"
          ".local/share/Mindustry"
          ".local/share/Steam"
          ".local/share/zoxide"
          ".ssh"
          ".steam"
          "conf"
          "Downloads"
          "conf_v1"
          "pp"
        ];
        files = [
          ".bash_history"
        ];
      };
    }
  );
}