diff --git a/launch/options.nix b/launch/options.nix
new file mode 100644
index 00000000..c090b372
--- /dev/null
+++ b/launch/options.nix
@@ -0,0 +1,53 @@
+{
+  lib,
+  ...
+}:
+let
+  inherit (lib) types mkOption;
+  inherit (types) str enum submodule;
+in
+{
+  options.terraform = {
+    domain = mkOption {
+      type = enum [
+        "fediversity.net"
+      ];
+      description = ''
+        Apex domain under which the services will be deployed.
+      '';
+      default = "fediversity.net";
+    };
+    hostname = mkOption {
+      type = str;
+      description = ''
+        Internal name of the host, e.g. test01
+      '';
+    };
+    initialUser = mkOption {
+      description = ''
+        Some services require an initial user to access them.
+        This option sets the credentials for such an initial user.
+      '';
+      type = submodule {
+        options = {
+          displayName = mkOption {
+            type = str;
+            description = "Display name of the user";
+          };
+          username = mkOption {
+            type = str;
+            description = "Username for login";
+          };
+          email = mkOption {
+            type = str;
+            description = "User's email address";
+          };
+          password = mkOption {
+            type = str;
+            description = "Password for login";
+          };
+        };
+      };
+    };
+  };
+}
diff --git a/launch/shared.nix b/launch/shared.nix
index 70d69831..fd7436c6 100644
--- a/launch/shared.nix
+++ b/launch/shared.nix
@@ -1,10 +1,10 @@
 {
   pkgs,
-  terraform,
+  config,
   ...
 }:
 let
-  inherit (terraform) hostname;
+  inherit (config.terraform) hostname domain initialUser;
 in
 {
   imports = [
@@ -17,12 +17,12 @@ in
   ];
   fediversityVm.name = hostname;
   fediversity = {
-    inherit (terraform) domain;
+    inherit domain;
     temp.initialUser = {
-      inherit (terraform.initialUser) username email displayName;
+      inherit (initialUser) username email displayName;
       # FIXME: disgusting, but nvm, this is going to be replaced by
       # proper central authentication at some point
-      passwordFile = pkgs.writeText "password" terraform.initialUser.password;
+      passwordFile = pkgs.writeText "password" initialUser.password;
     };
   };
 }