rec {
  users = import ./users.nix;

  adminSSHKeys = builtins.concatLists (
    map (user: getSSHKeys user.name) (
      builtins.filter (user: user.value.options.admin or false) (attrsToList users)
    )
  );

  attrsToList = mapAttrsToList nameValuePair;
  mapAttrsToList = f: attrs: builtins.attrValues (builtins.mapAttrs f attrs);
  nameValuePair = name: value: { inherit name value; };
  toList = x: if builtins.isList x then x else [ x ];

  getSSHKeys =
    username:
    if (builtins.hasAttr "ssh" users.${username}) then
      toList users.${username}.ssh
    else
      builtins.warn "user ${username} declared without ssh key" [ ];
}