{
  normalUsers.cryotherm = {
    extraGroups = [ ];
    # No sshKeyFiles, so password login only (if allowed) or local access
    sshKeyFiles = [ ];
  };
}