{ self, ... }: {
  #TODO[epic=Moderate] Move this somewhere else, would prefer not relying on this module
  flake.nixosModules."client-services" = { ... }: {
    imports = [
      self.nixosModules.systemBluetooth
      self.nixosModules.systemDeployBuilder
    ];

    chiasson.system.deploy.builder.enable = true;

    # Lab-ish SSH defaults on clients — tighten for anything exposed.
    services.openssh = {
      enable = true;
      settings = {
        KbdInteractiveAuthentication = false;
        PasswordAuthentication = true;
        PermitRootLogin = "yes"; # consider tightening later
        UseDns = false;
      };
    };

    # Printing, polkit, udisks.
    services.printing.enable = true;
    security.polkit.enable = true;
    services.udisks2.enable = true;

    sops = {
      defaultSopsFile = ../../secrets/secrets.yaml;
      defaultSopsFormat = "yaml";
      age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
    };

    sops.secrets."caching/attic/token" = {
      owner = "olivier";
      group = "users";
      mode = "0400";
    };

    sops.secrets."swiftshare/API_KEY" = {
      owner = "olivier";
      group = "users";
      mode = "0400";
    };

    sops.secrets."gitcrypt/personal-docs-key" = {
      sopsFile = ../../secrets/gitcrypt-personal-docs-key;
      format = "binary";
      owner = "olivier";
      group = "users";
      mode = "0400";
    };
  };
}