{
  pkgs,
  config,
  lib,
  ...
}: let
  ifTheyExist = groups: builtins.filter (group: builtins.hasAttr group config.users.groups) groups;
in {
  users.users.Winter= {
    isNormalUser = true;
    extraGroups = ifTheyExist [
      "audio"
      "deluge"
      "docker"
      "git"
      "i2c"
      "libvirtd"
      "minecraft"
      "mysql"
      "wpa_supplicant"
      "plugdev"
      "podman"
      "tss"
      "video"
      "wheel"
      "wireshark"
    ];

    # TODO: use as needed
    #openssh.authorizedKeys.keys = lib.splitString "\n" (builtins.readFile ../../../../home/gabriel/ssh.pub);
    #hashedPasswordFile = config.sops.secrets.gabriel-password.path;
    #packages = [pkgs.home-manager];
  };

  # unused for now, may add sops later on
  #sops.secrets = {
  #  gabriel-password = {
  #    sopsFile = ../../secrets.yaml;
  #    neededForUsers = true;
  #  };
  #};

# TODO: ensure correct paths
  home-manager.users.Winter = import ../../../../home/Winter/${config.networking.hostName}.nix;

  security.pam.services = {
    swaylock = {};
  };
}