{ pkgs, ... }: {

  users.users.root = {
    hashedPassword = "$6$fN9J7sDWZCJU$bybWVlYNHod4qXOTWDl9UZZgn7Bkb17ulM6wTr7hAhyQT4wlmW0An7pcXiYu3SqjSVnEmlma5uujfZ6Z.ZUL91";

    # read all pub keys from ./pubkeys
    openssh.authorizedKeys.keys = map builtins.readDir ./pubkeys;
  };

}