move nix remote builder to a module

flake.nix

@@ -43,6 +43,7 @@
               };
               modules = [
                 ./hosts/${hostname}
+                ./modules
                 ./system
               ];
             };

hosts/genepi/builder.nix

@@ -1,18 +1,7 @@
 { keys, ... }:
-let
-  username = "nixremote";
-in
 {
-  users.users."${username}" = {
+  roles.remote-builder = {
-    createHome = true;
+    enable = true;
-    home = "/home/${username}";
+    authorizedKeys = [ keys.hosts.haze ];
-    isSystemUser = true;
-    group = username;
-    useDefaultShell = true;
-    openssh.authorizedKeys.keys = [ keys.hosts.haze ];
   };
-
-  users.groups."${username}" = { };
-
-  nix.settings.trusted-users = [ username ];
 }

modules/default.nix

@@ -0,0 +1,5 @@
+{
+  imports = [
+    ./remote-builder.nix
+  ];
+}

modules/remote-builder.nix

@@ -0,0 +1,49 @@
+{ config, lib, ... }:
+let
+  cfg = config.roles.remote-builder;
+in
+{
+  options = {
+    roles.remote-builder = {
+      enable = lib.mkEnableOption {
+        description = "Whether to allow remote building on this machine";
+      };
+
+      user = lib.mkOption {
+        type = lib.types.str;
+        default = "nixremote";
+        example = "remote-builder";
+        description = "The name of the user used to run the builds";
+      };
+
+      group = lib.mkOption {
+        type = lib.types.str;
+        default = "${cfg.user}";
+        example = "remote-builder";
+        description = "The group of the user used to run the builds";
+      };
+
+      authorizedKeys = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [ ];
+        example = [ "ssh-ed25519 AAAA... user@host" ];
+        description = "List of SSH keys authorized to run builds on this machine";
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    users.users."${cfg.user}" = {
+      createHome = true;
+      home = "/home/${cfg.user}";
+      isSystemUser = true;
+      group = cfg.group;
+      useDefaultShell = true;
+      openssh.authorizedKeys.keys = cfg.authorizedKeys;
+    };
+
+    users.groups.${cfg.user} = { };
+
+    nix.settings.trusted-users = [ cfg.user ];
+  };
+}