users.users.nixosfoundationbackups =
    let
      zfs-ssh = pkgs.writeScript "zfs-ssh" ''
        #! /bin/sh -e
        [[ "$SSH_ORIGINAL_COMMAND" == zfs* ]]
        eval "$SSH_ORIGINAL_COMMAND"
      '';
    in {
      # the user needs to be able to execute commands remotely, thus having a shell:
      isNormalUser = true;
      openssh.authorizedKeys.keys = [
        "command=\"${zfs-ssh}\",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOyyr/4fMKQ1fwa5DjFVIHQLchr4EKcOWEI++gYBTbWF root@haumea"
      ];
    };