diff --git a/README.md b/README.md
index 3d83687..c357891 100644
--- a/README.md
+++ b/README.md
@@ -24,38 +24,43 @@ firmware.
 
 ```nix
 let
-  pkgs = import <nixpkgs> {};
-
-  # use fetchurl, Hydra inputs, or something else to refer to this project
   openwrt-imagebuilder = ../nix-openwrt-imagebuilder;
 
-  profiles = import (openwrt-imagebuilder + "/profiles.nix") { inherit pkgs; };
+  openwrtSystem = import (openwrt-imagebuilder + "/lib/openwrt-system.nix");
 
-  # example: find target/variant for an old Fritzbox
-  config = profiles.identifyProfile "avm_fritz7412" // {
-    # add package to include in the image, ie. packages that you don't
-    # want to install manually later
-    packages = [ "tcpdump" ];
+  sys = openwrtSystem {
+    pkgs = import <nixpkgs> { };
+    modules = [
+      ({ pkgs, ... }: {
 
-    disabledServices = [ "dnsmasq" ];
+        # find target/variant for an old Fritzbox
+        system.profile = "avm_fritz7412";
 
-    # include files in the images.
-    # to set UCI configuration, create a uci-defauts scripts as per
-    # official OpenWRT ImageBuilder recommendation.
-    files = pkgs.runCommandNoCC "image-files" {} ''
-      mkdir -p $out/etc/uci-defaults
-      cat > $out/etc/uci-defaults/99-custom <<EOF
-      uci -q batch << EOI
-      set system.@system[0].hostname='testap'
-      commit
-      EOI
-      EOF
-    '';
+        # add package to include in the image, ie. packages that you don't
+        # want to install manually later
+        packages = [ "tcpdump" ];
+
+        services.disabled = [ "dnsmasq" ];
+
+        # include files in the images.
+        # to set UCI configuration, create a uci-defauts scripts as per
+        # official OpenWRT ImageBuilder recommendation.
+        files = pkgs.runCommandNoCC "image-files" { } ''
+          mkdir -p $out/etc/uci-defaults
+          cat > $out/etc/uci-defaults/99-custom <<EOF
+          uci -q batch << EOI
+          set system.@system[0].hostname='testap'
+          commit
+          EOI
+          EOF
+        '';
+
+      })
+    ];
   };
 
-in
   # actually build the image
-  import (openwrt-imagebuilder + "/builder.nix") config
+in sys.config.system.build.image
 ```
 
 ## Usage with Nix Flakes
@@ -66,35 +71,36 @@ in
     openwrt-imagebuilder.url = "github:astro/nix-openwrt-imagebuilder";
   };
   outputs = { self, nixpkgs, openwrt-imagebuilder }: {
-    packages.x86_64-linux.my-router =
-      let
+    packages.x86_64-linux.my-router = let
+      sys = openwrt-imagebuilder.lib.openwrtSystem {
         pkgs = nixpkgs.legacyPackages.x86_64-linux;
+        modules = [
+          ({ pkgs, ... }: {
+            system.profile = "avm_fritz7412";
 
-        profiles = openwrt-imagebuilder.lib.profiles { inherit pkgs; };
+            # add package to include in the image, ie. packages that you don't
+            # want to install manually later
+            packages = [ "tcpdump" ];
 
-        config = profiles.identifyProfile "avm_fritz7412" // {
-          # add package to include in the image, ie. packages that you don't
-          # want to install manually later
-          packages = [ "tcpdump" ];
+            services.disabled = [ "dnsmasq" ];
 
-          disabledServices = [ "dnsmasq" ];
+            # include files in the images.
+            # to set UCI configuration, create a uci-defauts scripts as per
+            # official OpenWRT ImageBuilder recommendation.
+            files = pkgs.runCommandNoCC "image-files" { } ''
+              mkdir -p $out/etc/uci-defaults
+              cat > $out/etc/uci-defaults/99-custom <<EOF
+              uci -q batch << EOI
+              set system.@system[0].hostname='testap'
+              commit
+              EOI
+              EOF
+            '';
 
-          # include files in the images.
-          # to set UCI configuration, create a uci-defauts scripts as per
-          # official OpenWRT ImageBuilder recommendation.
-          files = pkgs.runCommandNoCC "image-files" {} ''
-            mkdir -p $out/etc/uci-defaults
-            cat > $out/etc/uci-defaults/99-custom <<EOF
-            uci -q batch << EOI
-            set system.@system[0].hostname='testap'
-            commit
-            EOI
-            EOF
-          '';
-        };
-
-      in
-        openwrt-imagebuilder.lib.build config;
+          })
+        ];
+      };
+    in sys.config.system.build.image;
   };
 }
 ```
diff --git a/example.nix b/example.nix
index f08a2ea..397d3c4 100644
--- a/example.nix
+++ b/example.nix
@@ -1,23 +1,18 @@
-{ pkgs ? import <nixpkgs> {}
-, profiles ? import ./profiles.nix { inherit pkgs; }
-, build ? import ./builder.nix
-}:
-build (
-  profiles.identifyProfile "avm_fritz7412"
-  //
-  {
-    packages = [
-      "tcpdump"
-      "vxlan" "kmod-vxlan"
-    ];
-    files = pkgs.runCommandNoCC "image-files" {} ''
-      mkdir -p $out/etc/uci-defaults
-      cat > $out/etc/uci-defaults/99-custom <<EOF
-      uci -q batch << EOI
-      set system.@system[0].hostname='testap'
-      commit
-      EOI
-      EOF
-    '';
-  }
-)
+{ pkgs, ... }:
+
+{
+  system.profile = "avm_fritz7412";
+
+  packages = [ "tcpdump" "vxlan" "kmod-vxlan" ];
+
+  files = pkgs.runCommandNoCC "image-files" { } ''
+       mkdir -p $out/etc/uci-defaults
+       cat > $out/etc/uci-defaults/99-custom <<EOF
+       uci -q batch << EOI
+       set system.@system[0].hostname='testap'
+       commit
+       EOI
+       EOF
+     '';
+
+}
diff --git a/flake.nix b/flake.nix
index 832c0a2..7327cc0 100644
--- a/flake.nix
+++ b/flake.nix
@@ -1,46 +1,39 @@
 {
   description = "Build OpenWRT images in Nix derivations";
 
-  outputs = { self, nixpkgs }@inputs: {
+  outputs = { self, nixpkgs }@inputs:
+    let pkgs' = nixpkgs.legacyPackages.x86_64-linux;
+    in {
 
-    lib.build =
-      { pkgs ? nixpkgs.legacyPackages.x86_64-linux
-      , ...
-      }@args:
-      import ./builder.nix (args // {
-        inherit pkgs;
-      });
+      lib = {
+        build = { pkgs ? pkgs', ... }@args:
+          import ./builder.nix (args // { inherit pkgs; });
 
-    lib.profiles =
-      { pkgs ? nixpkgs.legacyPackages.x86_64-linux
-      , release ? "21.02.3"
-      , ...
-      }@args:
-      import ./profiles.nix (args // {
-        inherit pkgs release;
-      });
+        profiles = { pkgs ? pkgs', release ? "21.02.3", ... }@args:
+          import ./profiles.nix (args // { inherit pkgs release; });
 
-    packages.x86_64-linux.profiles-list = import ./profiles-list.nix {
-      pkgs = nixpkgs.legacyPackages.x86_64-linux;
-    };
-
-    # `nix run .#generate-hashes`
-    packages.x86_64-linux.generate-hashes = import ./generate-hashes.nix {
-      pkgs = nixpkgs.legacyPackages.x86_64-linux;
-    };
-
-    packages.x86_64-linux.example-image = import ./example.nix {
-      pkgs = nixpkgs.legacyPackages.x86_64-linux;
-      profiles = self.lib.profiles {
-        pkgs = nixpkgs.legacyPackages.x86_64-linux;
+        openwrtSystem = import ./lib/openwrt-system.nix;
       };
-      build = self.lib.build;
-    };
 
-    checks = self.packages;
+      packages.x86_64-linux.profiles-list = import ./profiles-list.nix {
+        pkgs = pkgs';
+      };
 
-    hydraJobs = {
-      example-image = nixpkgs.lib.hydraJob self.packages.x86_64-linux.example-image;
+      # `nix run .#generate-hashes`
+      packages.x86_64-linux.generate-hashes = import ./generate-hashes.nix {
+        pkgs = pkgs';
+      };
+
+      packages.x86_64-linux.example-image = self.lib.openwrtSystem {
+        pkgs = pkgs';
+        modules = [ ./example.nix ];
+      };
+
+      checks = self.packages;
+
+      hydraJobs = {
+        example-image =
+          nixpkgs.lib.hydraJob self.packages.x86_64-linux.example-image;
+      };
     };
-  };
 }
diff --git a/lib/modules/build.nix b/lib/modules/build.nix
new file mode 100644
index 0000000..b8841b3
--- /dev/null
+++ b/lib/modules/build.nix
@@ -0,0 +1,10 @@
+{ config, lib, pkgs, profiles, ... }:
+
+{
+  system.build.image = import ../../builder.nix {
+    inherit pkgs;
+    inherit (config.system) release target variant profile;
+    inherit (config) packages files;
+    disabledServices = config.services.disabled;
+  };
+}
diff --git a/lib/modules/files.nix b/lib/modules/files.nix
new file mode 100644
index 0000000..ec9c3e5
--- /dev/null
+++ b/lib/modules/files.nix
@@ -0,0 +1,21 @@
+{ lib, ... }:
+
+{
+  options.files = with lib;
+    mkOption {
+      type = types.path;
+      default = null;
+      example = literalExample ''
+        pkgs.runCommandNoCC "image-files" { } '''
+          mkdir -p $out/etc/uci-defaults
+          cat > $out/etc/uci-defaults/99-custom <<EOF
+          uci -q batch << EOI
+          set system.@system[0].hostname='testap'
+          commit
+          EOI
+          EOF
+        ''';
+      '';
+      description = "Directory of files to included in images.";
+    };
+}
diff --git a/lib/modules/packages.nix b/lib/modules/packages.nix
new file mode 100644
index 0000000..fa8e34a
--- /dev/null
+++ b/lib/modules/packages.nix
@@ -0,0 +1,10 @@
+{ lib, ... }:
+
+{
+  options.packages = with lib; mkOption {
+    type = with types; listOf str;
+    default = [ ];
+    example = [ "tcpdump" "vxlan" "kmod-vxlan" ];
+    description = "Extra OpenWRT packages (can be prefixed with "-").";
+  };
+}
diff --git a/lib/modules/services.nix b/lib/modules/services.nix
new file mode 100644
index 0000000..7a8c10a
--- /dev/null
+++ b/lib/modules/services.nix
@@ -0,0 +1,10 @@
+{ lib, ... }:
+
+{
+  options.services.disabled = with lib; mkOption {
+    type = with types; listOf str;
+    default = [ ];
+    example = [ "dropbear" ];
+    description = "Which services in /etc/init.d/ should be disabled.";
+  };
+}
diff --git a/lib/modules/system.nix b/lib/modules/system.nix
new file mode 100644
index 0000000..d8c8ae3
--- /dev/null
+++ b/lib/modules/system.nix
@@ -0,0 +1,49 @@
+{ config, lib, pkgs, profiles, ... }:
+
+let cfg = config.system;
+in {
+  options.system = with lib;
+    let nullOrStr = types.nullOr types.str;
+    in {
+
+      build = mkOption {
+        default = { };
+        description = ''
+          Attribute set of derivations used to construct the system.
+        '';
+        type = types.submoduleWith {
+          modules =
+            [{ freeformType = with types; lazyAttrsOf (uniq unspecified); }];
+        };
+      };
+
+      profile = mkOption {
+        type = nullOrStr;
+        default = null;
+        description = "Hardware profile";
+      };
+
+      release = mkOption {
+        type = types.str;
+        default = "21.02.3";
+        description = "OpenWRT release";
+      };
+
+      target = mkOption {
+        type = types.str;
+        description = "OpenWRT target";
+      };
+
+      variant = mkOption {
+        type = types.str;
+        description = "Hardware variant";
+      };
+
+    };
+
+  config.system = lib.mkIf (cfg.profile != null)
+    (lib.mapAttrs (_: lib.mkDefault) {
+      inherit (profiles.identifyProfile cfg.profile) target variant;
+    });
+
+}
diff --git a/lib/openwrt-system.nix b/lib/openwrt-system.nix
new file mode 100644
index 0000000..94e73b0
--- /dev/null
+++ b/lib/openwrt-system.nix
@@ -0,0 +1,22 @@
+{ pkgs ? import <nixpkgs> { }, modules }:
+
+let
+  result = pkgs.lib.evalModules {
+    modules = [
+      ({ config, ... }: {
+        config._module.args = {
+          inherit pkgs;
+          profiles = import ../profiles.nix {
+            inherit pkgs;
+            inherit (config.system) release;
+          };
+        };
+      })
+      ./modules/system.nix
+      ./modules/files.nix
+      ./modules/packages.nix
+      ./modules/services.nix
+      ./modules/build.nix
+    ] ++ modules;
+  };
+in { inherit (result) config options; }