{
  environment.sessionVariables.DBUS_SESSION_BUS_ADDRESS = "unix:path=/run/sidebus.sock";
  systemd.sockets.sidebus-agent = {
    # SocketMode= is 0666 by default
    listenStreams = [ "/run/sidebus.sock" ];
    wantedBy = [ "sockets.target" ];
    documentation = [ "https://git.clan.lol/valpackett/sidebus" ];
  };
  systemd.services.sidebus-agent = {
    # TODO: confinement (can do a lot)
    serviceConfig = {
      ExecStart = throw "sidebus-vm module requires setting systemd.services.sidebus-agent.serviceConfig.ExecStart to a sidebus-agent package";
      ImportCredential = "sidebus.*";
    };
    documentation = [ "https://git.clan.lol/valpackett/sidebus" ];
  };
  systemd.mounts = [
    {
      type = "virtiofs";
      what = "vm-doc-portal";
      where = "/run/vm-doc-portal";
      wantedBy = [ "multi-user.target" ];
    }
  ];
}