{ customUtils, flake, config, lib, ... }:

{
  imports = with flake.nixosModules.systemProfiles; [ openssh ];
  
  config = {
    users.groups.nix-ssh-builder = {};
    users.users.nix-ssh-builder = {
      description = "Nix build server user";
      useDefaultShell = true;
      isSystemUser = true;
      group = "nix-ssh-builder";
    };

    services.openssh = {
      enable = true;
      extraConfig = ''
        Match User nix-ssh-builder
          AllowAgentForwarding no
          AllowTcpForwarding no
          PermitTTY no
          PermitTunnel no
          X11Forwarding no
          ForceCommand ${config.nix.package.out}/bin/nix-store --serve --write
        Match All
      '';
    };

    users.users.nix-ssh-builder.openssh.authorizedKeys.keys =
      let
        importKeys = dir: lib.attrValues (customUtils.mapFilterAttrs (_: v: v != null) (n: v: lib.nameValuePair n (if v == "directory" then importKeys' dir n else null)) (builtins.readDir dir));
        importKeys' = dir: host: builtins.readFile (dir + "/${host}/public");
      in importKeys ./clients;
  };
}