{
  pkgs,
  ...
}: {
  users.users.drone = {
    isNormalUser = true;
    description = "builder";
    extraGroups = [
      "wheel"
      "docker"
    ];
    shell = pkgs.zsh;
    openssh.authorizedKeys.keys = [
      ############
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILrZETtzrSfkomL9H31SuyQJ8O39ujMIjsCkbjL4DgxM"
      #ipad
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDiL1HC9SzfP1Bm3ZDU3QOKEIfyRVry1e+G5egtw9/hA mobile@localhost"
      #ssh iphone
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFcWcFktM6blTjTyGh7iw7Dp7oTt18kebJWqWbw+48xQ mobile@localhost"
      #moshi iphone
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG/k8lPcm7nP0plnAcl0tR6VQSDCtvJl9fqhQlt11cS6 moshi"
      #root tnix
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICb7MnxZch2IfxkFhKjGWkAVeAENJFEFaMk91UQTiQBf root@tnix"
      #blunix
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIByyKW+cgtXpir9qhLMyoBOjQj932es1Yr3/BxqTHU6J drone@blunix"
    ];
  };

  # drone has no home-manager profile, so ~/.zshrc doesn't exist -- without
  # it, interactive zsh runs the zsh-newuser-install wizard on every login.
  # An empty file (never overwritten once it exists) is enough to skip it;
  # actual config comes from /etc/zshrc (hosts/globalServices/zsh.nix).
  systemd.tmpfiles.rules = [
    "f /home/drone/.zshrc 0644 drone users - -"
  ];
}