{ lib, config, ... }: {
  options = {
    services.power-management.enable = lib.mkEnableOption "power-management";
  };
  config = lib.mkIf config.services.power-management.enable {
    services = {
      power-profiles-daemon.enable = true;
      upower.enable = true;
    };

    users.groups.power = { };

    security.polkit = {
      extraConfig = ''
        polkit.addRule(function(action, subject) {
            if (action.id == "org.freedesktop.systemd1.manage-units" ||
                action.id == "org.freedesktop.systemd1.manage-unit-files") {
                if (action.lookup("unit") == "poweroff.target") {
                    if (subject.isInGroup("power")) {
                        return polkit.Result.YES;
                    } else {
                        return polkit.Result.AUTH_ADMIN;
                    }
                }
            }
        });
      '';
    };
  };
}