{ lib, ... }: {
  options.optionModules.ssh-certs = lib.mkOption {
    type = lib.types.deferredModule;
    description = "SSH certificate options";
  };

  config.optionModules.ssh-certs = { config, lib, pkgs, ... }: {
    # Needed for some kind of de-duping when this module is used more than once?
    key = "ssh-cert-config";
    _file = "modules/features/ssh/config.nix";

    options.ssh-new = {
      user = {
        keyFile = lib.mkOption {
          type = lib.types.str;
          default = "id_ed25519";
        };
      };
      host = {
        configDir = lib.mkOption {
          type = lib.types.str;
          default = "/etc/ssh";
        };
        keyFile = lib.mkOption {
          description = "String path to the host private key file";
          type = lib.types.str;
          default = "ssh_host_ed25519_key";
        };
        keyType = lib.mkOption {
          description = "OpenSSH host key type for ssh.hostKey.";
          type = lib.types.enum [ "ed25519" "rsa" "ecdsa" ];
          default = "ed25519";
        };
        extraSettings = lib.mkOption {
          description = "Extra settings to merge";
          type = lib.types.attrs;
          default = { };
        };
        enable-scripts = lib.mkEnableOption "Enable SSH host cert management scripts";
      };
      certificates = {
        provisioner = lib.mkOption {
          type = lib.types.nullOr lib.types.str;
          default = null;
        };
        provisionerPasswordFile = lib.mkOption {
          type = lib.types.nullOr lib.types.str;
          default = null;
        };
        overwrite = lib.mkEnableOption "Overwrite existing certificate files";
        user = {
          enable = lib.mkEnableOption "Enable SSH user certs";
          CAFile = lib.mkOption {
            description = "Filename of the SSH user CA with the config directory";
            type = lib.types.str;
            default = "ssh_user_ca_key.pub";
          };
          extraPrincipals = lib.mkOption {
            type = lib.types.listOf lib.types.str;
            default = [ "root" "john" "appdaemon" ];
          };
        };
        host = {
          enable = lib.mkEnableOption "Enable SSH host certs";
          autoRenew = lib.mkEnableOption "Auto-renew the SSH host certs with a systemd service/timer";
          extraPrincipals = lib.mkOption {
            type = lib.types.listOf lib.types.str;
            default = [ ];
          };
          expires-in = lib.mkOption {
            description = "Duration passed to step ssh needs-renewal --expires-in.";
            type = lib.types.str;
            default = "4h";
          };
        };
      };
    };
  };
}