diff --git a/examples/rotuer.nix b/examples/rotuer.nix
index 0a38ae1a..a0ac34ff 100644
--- a/examples/rotuer.nix
+++ b/examples/rotuer.nix
@@ -11,7 +11,6 @@ let
   secrets = import ./rotuer-secrets.nix;
   inherit (pkgs.liminix.networking)
     address
-    hostapd
     interface
     route;
   inherit (pkgs.liminix.services) oneshot longrun bundle target;
@@ -36,6 +35,7 @@ in rec {
     ../modules/ppp
     ../modules/dnsmasq
     ../modules/firewall
+    ../modules/hostapd
   ];
   rootfsType = "jffs2";
   hostname = "rotuer";
@@ -45,7 +45,8 @@ in rec {
     };
   };
 
-  services.hostap = hostapd (config.hardware.networkInterfaces.wlan_24) {
+  services.hostap = config.system.service.hostapd {
+    interface = config.hardware.networkInterfaces.wlan_24;
     params = {
       ssid = "liminix";
       country_code = "GB";
@@ -62,7 +63,8 @@ in rec {
     };
   };
 
-  services.hostap5 = hostapd (config.hardware.networkInterfaces.wlan_5) {
+  services.hostap5 = config.system.service.hostapd {
+    interface = config.hardware.networkInterfaces.wlan_5;
     params = rec {
       ssid = "liminix_5";
       country_code = "GB";
diff --git a/modules/hostapd/default.nix b/modules/hostapd/default.nix
new file mode 100644
index 00000000..c02303be
--- /dev/null
+++ b/modules/hostapd/default.nix
@@ -0,0 +1,13 @@
+{ lib, pkgs, config, ...}:
+let
+  inherit (lib) mkOption types;
+in {
+  options = {
+    system.service.hostapd = mkOption {
+      type = types.functionTo types.package;
+    };
+  };
+  config = {
+    system.service.hostapd = pkgs.callPackage ./service.nix {};
+  };
+}
diff --git a/pkgs/liminix-tools/networking/hostapd.nix b/modules/hostapd/service.nix
similarity index 53%
rename from pkgs/liminix-tools/networking/hostapd.nix
rename to modules/hostapd/service.nix
index d57b0a9e..c371791f 100644
--- a/pkgs/liminix-tools/networking/hostapd.nix
+++ b/modules/hostapd/service.nix
@@ -1,23 +1,34 @@
-# This is not a friendly interface to configuring a wireless AP: it
-# just passes everything straight through to the hostapd config.  When
-# we've worked out what the sensible options are to expose, we'll add
-# them as top-level attributes and rename params to extraParams
-
 {
   liminix
 , hostapd
-, lib
 , writeText
-}:
-interface:
-{
-  params ? {}
+, lib
 }:
 let
   inherit (liminix.services) longrun;
   inherit (lib) concatStringsSep mapAttrsToList;
-  inherit (builtins) toString;
+  inherit (liminix.lib) typeChecked;
+  inherit (lib) mkOption types;
 
+  # This is not a friendly interface to configuring a wireless AP: it
+  # just passes everything straight through to the hostapd config.
+  # When we've worked out what the sensible options are to expose,
+  # we'll add them as top-level attributes and rename params to
+  # extraParams
+
+  t = {
+    interface = mkOption {
+      type = liminix.lib.types.service;
+    };
+    params = mkOption {
+      type = types.attrs;
+    };
+  };
+in
+args:
+let
+  inherit (typeChecked "hostapd" t args)
+    interface params;
   name = "${interface.device}.hostapd";
   defaults =  {
     driver = "nl80211";