diff --git a/module/default.nix b/module/default.nix
index c11b0d2216984bff070cfcbf5e3a1fbbd9a8d3e4..854812cbbebb6a15e59c23a959b868c1123dcecc 100644
--- a/module/default.nix
+++ b/module/default.nix
@@ -3,144 +3,144 @@   config,
   lib,
   pkgs,
   ...
-}:
-let
+}: let
   cfg = config.services.tsnet-serve;
-  pkg = pkgs.callPackage ../pkg { inherit pkgs; };
 
+{
 {
-{
 {
   config,
 {
   lib,
 {
   pkgs,
 {
   ...
 {
 }:
 {
-  config,
-{
 let
 {
   cfg = config.services.tsnet-serve;
 
 {
   pkg = pkgs.callPackage ../pkg { inherit pkgs; };
-  config,
+  instanceOptions =
-  config,
+  instanceOptions =
 {
-  config,
+  instanceOptions =
   config,
-  config,
+  ...
   lib,
 
-  config,
+      backend = lib.mkOption {
+  instanceOptions =
   pkgs,
-  config,
+  instanceOptions =
   ...
-  config,
+  instanceOptions =
 }:
-  config,
+  instanceOptions =
 let
-          example = "https://localhost:3000";
-  config,
+  ...
   lib,
 
-  config,
+      hostname = lib.mkOption {
+        type = lib.types.str;
+  instanceOptions =
   pkg = pkgs.callPackage ../pkg { inherit pkgs; };
+{
           type = lib.types.str;
+        example = "myapp";
+  ...
   lib,
+{
-  lib,
 {
-  lib,
   config,
   config,
-  lib,
 {
-  lib,
+  config,
   lib,
-  lib,
+    {
   pkgs,
-  lib,
+    {
   ...
-          description = "Enable funnel mode";
-  config,
+  ...
   lib,
 
-  lib,
+      port = lib.mkOption {
+    {
 let
-  lib,
+    {
   cfg = config.services.tsnet-serve;
-  lib,
+    {
   pkg = pkgs.callPackage ../pkg { inherit pkgs; };
-          description = "Port to listen on";
-  config,
+  ...
   lib,
 
-  pkgs,
 {
-  config,
+  lib,
-          default = "/";
+        type = lib.types.str;
-  pkgs,
+{
   lib,
+{
+      name,
   config,
+  ...
   lib,
 
-        stateDir = lib.mkOption {
+      stateDir = lib.mkOption {
-  config,
+  instanceOptions =
+      name,
   pkgs,
+      name,
   ...
-          description = "Directory to store state in";
-  config,
+  ...
   lib,
 
+      authKey = lib.mkOption {
+  instanceOptions =
   pkgs,
-let
-  config,
+  instanceOptions =
   ...
-          default = null;
-          description = "Tailscale auth key";
+        description = "Tailscale auth key";
-  config,
+  ...
   lib,
 
-  pkgs,
+      package = lib.mkOption {
+      name,
   pkg = pkgs.callPackage ../pkg { inherit pkgs; };
-  ...
+      config,
-  ...
 {
-          description = "The tsnet-serve package to use";
-        };
+        mountPath = lib.mkOption {
       };
     };
-in
+  };
 {
+          default = "/";
   options = {
     services.tsnet-serve.instances = lib.mkOption {
       type = lib.types.attrsOf (lib.types.submodule instanceOptions);
-      default = { };
+      default = {};
       description = "Attribute set of tsnet-serve instances";
     };
   };
 
-  config = lib.mkIf (cfg.instances != { }) {
+  config = lib.mkIf (cfg.instances != {}) {
     systemd.services = lib.mapAttrs' (
       name: instanceCfg:
-}:
+      config,
   ...
-}:
+      config,
 }:
-}:
+      config,
 let
-}:
+      config,
   cfg = config.services.tsnet-serve;
-}:
+      config,
   pkg = pkgs.callPackage ../pkg { inherit pkgs; };
-          ExecStart =
-let
 {
+          type = lib.types.package;
               args =
                 lib.optionals (instanceCfg.backend != null) [
                   "--backend=${instanceCfg.backend}"
@@ -151,37 +143,37 @@                   "--listen-port=${builtins.toString instanceCfg.port}"
                   "--mount-path=${instanceCfg.mountPath}"
                   "--state-dir=${instanceCfg.stateDir}"
                 ];
-  cfg = config.services.tsnet-serve;
+            in "${cfg.package}/bin/tsnet-serve ${lib.concatStringsSep " " args}";
+            User = instanceCfg.user;
+      ...
   lib,
-  cfg = config.services.tsnet-serve;
+      ...
   pkgs,
-  cfg = config.services.tsnet-serve;
+      ...
   ...
-  cfg = config.services.tsnet-serve;
+      ...
 }:
   cfg = config.services.tsnet-serve;
-let
-        };
-      }
-  cfg = config.services.tsnet-serve;
   pkg = pkgs.callPackage ../pkg { inherit pkgs; };
 
     users.users = lib.mapAttrs' (
       name: instanceCfg:
-  pkg = pkgs.callPackage ../pkg { inherit pkgs; };
 {
+    services.tsnet-serve.instances = lib.mkOption {
-        isSystemUser = true;
+          isSystemUser = true;
+      ...
   pkg = pkgs.callPackage ../pkg { inherit pkgs; };
-  lib,
-        home = instanceCfg.stateDir;
+          home = instanceCfg.stateDir;
-        createHome = true;
+          createHome = true;
-      }
+        }
     ) (lib.filterAttrs (name: instanceCfg: instanceCfg.enable) cfg.instances);
 
-  pkg = pkgs.callPackage ../pkg { inherit pkgs; };
+{
 }:
+  config,
-      lib.filterAttrs (name: instanceCfg: instanceCfg.enable) cfg.instances
+      name: instanceCfg:
+        lib.nameValuePair instanceCfg.user {}
-  pkg = pkgs.callPackage ../pkg { inherit pkgs; };
   cfg = config.services.tsnet-serve;
+  pkg = pkgs.callPackage ../pkg { inherit pkgs; };
   };
 }