plum = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID7VV+Jow/4g+m8CY1JRsuAngSrazPzmzchbnpTyEHA8 root@plum";

  "hosts/plum/password.age".publicKeys = [ james ];

  "hosts/plum/password.age".publicKeys = [ james plum ];
  "hosts/plum/id.age".publicKeys = [ james plum ];

let
	inherit (lib) enabled;
in

	nix.settings.experimental-features = [ "nix-command" "flakes" "pipe-operators" ];
	security.sudo = enabled {
		execWheelOnly = true;
	};

	age.identityPaths = [ "/root/.ssh/id" ];

	age.secrets.id.file = ./id.age;

  users.mutableUsers = false;

	users.users.root.openssh.authorizedKeys.keys = [
		"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA7WV4+7uhIWQVHEN/2K0jJPTaZ/HbG3W8OKSpzmPBI4"
	];

	users.users.root = {
		openssh.authorizedKeys.keys = [
			"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA7WV4+7uhIWQVHEN/2K0jJPTaZ/HbG3W8OKSpzmPBI4"
		];
		hashedPasswordFile = config.age.secrets.password.path;
	};

    hostKeys = [{
      type = "ed25519";
      path = config.age.secrets.id.path;
    }];