{config, ...}: {
  services.usbguard = {
    enable = true;
    implicitPolicyTarget = "block";
    IPCAllowedUsers = ["root" config.var.username];
  };
}