{
  lib,
  config,
  ...
}:
let
  inherit (lib)
    attrNames
    mapAttrs
    mkOption
    genAttrs
    ;
  inherit (lib.types)
    attrsOf
    attrTag
    deferredModule
    mergeTypes
    nullOr
    submoduleWith
    submodule
    str
    ;
  runtime-configuration = mkOption {
    description = "The NixOS module of a run-time environment";
    type = deferredModule;
    default = {
      _class = "nixos";
    };
  };
  runtime-environment = attrTag (
    mapAttrs
      (
        name:
        option@{ type, ... }:
        mkOption (
          option
          // {
            type = mergeTypes type (submodule {
              options.module = mkOption {
                description = "The NixOS module of the run-time environment";
                type = deferredModule;
                default = config.runtime-configurations.${name};
                readOnly = true;
              };
            });
          }
        )
      )
      {
        vm = {
          description = "A VM to deploy to.";
          type = submodule {
            options = {
            };
          };
        };
        single-ssh-host = {
          description = "A single host to deploy to by SSH.";
          type = submodule {
            options = {
              ssh = mkOption {
                description = "SSH connection info";
                type = submodule {
                  options = {
                    host = mkOption {
                      description = "the host to access by SSH";
                      type = str;
                    };
                    username = mkOption {
                      description = "the SSH user to use";
                      type = nullOr str;
                      default = null;
                    };
                    authentication = mkOption {
                      description = "authentication method";
                      type = attrsOf (attrTag {
                        private-key = mkOption {
                          description = "path to the user's SSH private key";
                          type = str;
                          example = "/root/.ssh/id_ed25519";
                        };
                        password = mkOption {
                          description = "SSH password";
                          # TODO: mark as sensitive
                          type = str;
                        };
                      });
                    };
                  };
                };
              };
            };
          };
        };
      }
  );
  application = submoduleWith {
    description = "A Fediversity application";
    modules = [
      {
        options = {
          module = mkOption {
            description = "The NixOS module for that application, for configuring that application";
            type = deferredModule;
          };
        };
      }
    ];
  };
  deployment = submoduleWith {
    description = "A deployment of a configuration of applications to a run-time environment";
    modules = [
      {
        options = {
          # the `applications` option consists of configuration for the above applications
          module = mkOption {
            description = ''
              Configuration to be deployed
            '';
            type = deferredModule;
          };
          runtime-environment = mkOption {
            description = "The run-time environment to deploy to";
            type = runtime-environment;
          };
        };
      }
    ];
  };
in
{
  options = {
    runtime-configurations = mkOption {
      description = "Collection of runtime environments into which applications can be deployed";
      type = attrTag (genAttrs (attrNames runtime-environment.nestedTypes) (_: runtime-configuration));
    };
    runtime-environments = mkOption {
      description = "Collection of runtime environments into which applications can be deployed";
      type = attrsOf runtime-environment;
    };
    applications = mkOption {
      description = "Collection of Fediversity applications";
      type = attrsOf application;
    };
    deployments = mkOption {
      description = "Deployment of a configuration of applications to a run-time environment";
      type = attrsOf deployment;
    };
  };
}