{ self, inputs, ... }: {
  flake.modules.nixos.onepassword = { config, ... }: {
    programs._1password.enable = true;
    programs._1password-gui = {
      enable = true;
      # Certain features, including CLI integration and system authentication support,
      # require enabling PolKit integration on some desktop environments (e.g. Plasma).
      polkitPolicyOwners = [ "john" ];
      # TODO this should not be a hardcoded username
    };
  };

  flake.modules.homeManager.onepassword = { config, ... }: {
    home.file.".config/1Password/ssh/agent.toml".text = ''
      # https://developer.1password.com/docs/ssh/agent/config
      [[ssh-keys]]
      vault = "Private"
    '';
  };
}