{
	config,
		lib,
		modulesPath,
		pkgs,
		...
}:
{

	imports = [ (modulesPath + "/profiles/all-hardware.nix") ];

	options.usbauth = lib.mkOption {
		description = "USB Auth";
		type = lib.types.submodule {
			options = {
				enable = lib.mkOption { type = lib.types.bool; default = false; };
				device = lib.mkOption { type = lib.types.str; };
				keyname = lib.mkOption { type = lib.types.str; };
				uuid = lib.mkOption { type = lib.types.str; };
			};
		};
	};

	config = lib.mkIf config.usbauth.enable {
		boot.initrd.systemd.services.usb-auth-setup = {
			description = "USBAuth Setup";
			before = [ "cryptsetup-pre.target" ];

			serviceConfig = {
				Type = "oneshot";
				ExecStart = "${pkgs.bash}/bin/bash ${./usbauth.sh} ${config.usbauth.uuid}";
			};

			wantedBy = [ "sysinit.target" ];
		};

		boot.initrd.luks.devices."${config.usbauth.device}" = {
			keyFile = "/key/.keys/${config.usbauth.keyname}";
		};
	};
}