{ lib, ... }: {
  options.optionModules.mtls = lib.mkOption {
    type = lib.types.deferredModule;
    description = "Shared mTLS certificate option definitions, imported by the mTLS wrapper modules.";
  };

  config.optionModules.mtls = { config, lib, pkgs, ... }: {
    key = "mtls-config";
    _file = "modules/features/mtls/config.nix";
    options = {
      certDir = lib.mkOption {
        description = "String path to the directory where the certs will be stored";
        type = lib.types.str;
        default = "/etc/mtls";
      };
      keyFile = lib.mkOption {
        description = "String path for the private key";
        type = lib.types.str;
        default = "${config.certDir}/key.pem";
      };
      certFile = lib.mkOption {
        description = "String path for the public cert";
        type = lib.types.str;
        default = "${config.certDir}/cert.pem";
      };
      bundleFile = lib.mkOption {
        description = "String path for the mTLS key bundle";
        type = lib.types.str;
        default = "${config.certDir}/mtls.pem";
      };
      certGroup = lib.mkOption {
        description = "Group that should be granted read access to generated certificate material.";
        type = lib.types.str;
        default = "mtls";
      };
      subject = lib.mkOption {
        description = "Subject for the cert";
        type = lib.types.str;
      };
      provisioner = lib.mkOption {
        type = lib.types.nullOr lib.types.str;
      };
      provisionerPasswordFile = lib.mkOption {
        type = lib.types.nullOr lib.types.str;
      };
      overwrite = lib.mkEnableOption "Overwrite existing cert file?";
      SANs = lib.mkOption {
        description = "A list of Subject Alternative Names";
        type = lib.types.listOf lib.types.str;
        default = [ ];
      };
    };
  };
}