{
  secrets = {
    "ssh_keys/root/remotebuild.pub" = {
      path = "/root/.ssh/remotebuild.pub";
    };
  };
  users.users.remotebuild = {
    isNormalUser = true;
    createHome = false;
    group = "remotebuild";

    openssh.authorizedKeys.keyFiles = [/root/.ssh/remotebuild.pub];
  };

  users.groups.remotebuild = {};

  nix.settings.trusted-users = ["remotebuild"];
}