diff --git a/pbs-config/Cargo.toml b/pbs-config/Cargo.toml
index ed71a88c..7f4258bd 100644
--- a/pbs-config/Cargo.toml
+++ b/pbs-config/Cargo.toml
@@ -14,7 +14,7 @@ serde_json = "1.0"
 openssl = "0.10"
 nix = "0.19.1"
 regex = "1.2"
-
+once_cell = "1.3.1"
 
 proxmox = { version = "0.13.0", default-features = false, features = [ "cli" ] }
 
diff --git a/src/config/cached_user_info.rs b/pbs-config/src/cached_user_info.rs
similarity index 94%
rename from src/config/cached_user_info.rs
rename to pbs-config/src/cached_user_info.rs
index 47631575..960864f2 100644
--- a/src/config/cached_user_info.rs
+++ b/pbs-config/src/cached_user_info.rs
@@ -10,9 +10,9 @@ use proxmox::api::UserInformation;
 use proxmox::tools::time::epoch_i64;
 
 use pbs_api_types::{Authid, Userid, User, ApiToken, ROLE_ADMIN};
-use pbs_config::acl::{AclTree, ROLE_NAMES};
 
-use crate::tools::Memcom;
+use crate::acl::{AclTree, ROLE_NAMES};
+use crate::memcom::Memcom;
 
 /// Cache User/Group/Token/Acl configuration data for fast permission tests
 pub struct CachedUserInfo {
@@ -53,8 +53,8 @@ impl CachedUserInfo {
         }
 
         let config = Arc::new(CachedUserInfo {
-            user_cfg: super::user::cached_config()?,
-            acl_tree: pbs_config::acl::cached_config()?,
+            user_cfg: crate::user::cached_config()?,
+            acl_tree: crate::acl::cached_config()?,
         });
 
         let mut cache = CACHED_CONFIG.write().unwrap();
@@ -65,8 +65,9 @@ impl CachedUserInfo {
         Ok(config)
     }
 
-    #[cfg(test)]
-    pub(crate) fn test_new(user_cfg: SectionConfigData, acl_tree: AclTree) -> Self {
+    /// Only exposed for testing
+    #[doc(hidden)]
+    pub fn test_new(user_cfg: SectionConfigData, acl_tree: AclTree) -> Self {
         Self {
             user_cfg: Arc::new(user_cfg),
             acl_tree: Arc::new(acl_tree),
diff --git a/pbs-config/src/lib.rs b/pbs-config/src/lib.rs
index a5a50aff..3a3d51a6 100644
--- a/pbs-config/src/lib.rs
+++ b/pbs-config/src/lib.rs
@@ -1,4 +1,6 @@
 pub mod acl;
+mod cached_user_info;
+pub use cached_user_info::CachedUserInfo;
 pub mod domains;
 pub mod drive;
 pub mod key_config;
@@ -9,8 +11,11 @@ pub mod sync;
 pub mod tape_encryption_keys;
 pub mod tape_job;
 pub mod token_shadow;
+pub mod user;
 pub mod verify;
 
+pub(crate) mod memcom;
+
 use anyhow::{format_err, Error};
 
 pub use pbs_buildcfg::{BACKUP_USER_NAME, BACKUP_GROUP_NAME};
diff --git a/src/tools/memcom.rs b/pbs-config/src/memcom.rs
similarity index 98%
rename from src/tools/memcom.rs
rename to pbs-config/src/memcom.rs
index 11c71903..96b577b5 100644
--- a/src/tools/memcom.rs
+++ b/pbs-config/src/memcom.rs
@@ -38,7 +38,7 @@ impl Memcom {
 
     // Actual work of `new`:
     fn open() -> Result<Arc<Self>, Error> {
-        let user = pbs_config::backup_user()?;
+        let user = crate::backup_user()?;
         let options = CreateOptions::new()
             .perm(Mode::from_bits_truncate(0o660))
             .owner(user.uid)
diff --git a/src/config/user.rs b/pbs-config/src/user.rs
similarity index 96%
rename from src/config/user.rs
rename to pbs-config/src/user.rs
index 71ba5a49..13287738 100644
--- a/src/config/user.rs
+++ b/pbs-config/src/user.rs
@@ -16,9 +16,10 @@ use proxmox::api::{
 use pbs_api_types::{
     Authid, Userid, ApiToken, User,
 };
-use pbs_config::{open_backup_lockfile, replace_backup_config, BackupLockGuard};
 
-use crate::tools::Memcom;
+use crate::memcom::Memcom;
+
+use crate::{open_backup_lockfile, replace_backup_config, BackupLockGuard};
 
 lazy_static! {
     pub static ref CONFIG: SectionConfig = init();
@@ -133,8 +134,9 @@ pub fn save_config(config: &SectionConfigData) -> Result<(), Error> {
     Ok(())
 }
 
-#[cfg(test)]
-pub(crate) fn test_cfg_from_str(raw: &str) -> Result<(SectionConfigData, [u8;32]), Error> {
+/// Only exposed for testing
+#[doc(hidden)]
+pub fn test_cfg_from_str(raw: &str) -> Result<(SectionConfigData, [u8;32]), Error> {
     let cfg = init();
     let parsed = cfg.parse("test_user_cfg", raw)?;
 
diff --git a/src/api2/access/acl.rs b/src/api2/access/acl.rs
index 4dec3660..764bd46f 100644
--- a/src/api2/access/acl.rs
+++ b/src/api2/access/acl.rs
@@ -12,7 +12,7 @@ use pbs_api_types::{
 
 use pbs_config::acl::AclTreeNode;
 
-use crate::config::cached_user_info::CachedUserInfo;
+use pbs_config::CachedUserInfo;
 
 fn extract_acl_node_data(
     node: &AclTreeNode,
@@ -221,7 +221,7 @@ pub fn update_acl(
         bail!("parameter 'group' - groups are currently not supported.");
     } else if let Some(ref auth_id) = auth_id {
         if !delete { // Note: we allow to delete non-existent users
-            let user_cfg = crate::config::user::cached_config()?;
+            let user_cfg = pbs_config::user::cached_config()?;
             if user_cfg.sections.get(&auth_id.to_string()).is_none() {
                 bail!(format!("no such {}.",
                               if auth_id.is_token() { "API token" } else { "user" }));
diff --git a/src/api2/access/mod.rs b/src/api2/access/mod.rs
index f504d763..58ac8ca4 100644
--- a/src/api2/access/mod.rs
+++ b/src/api2/access/mod.rs
@@ -22,7 +22,7 @@ use pbs_config::acl::AclTreeNode;
 use crate::auth_helpers::*;
 use crate::server::ticket::ApiTicket;
 
-use crate::config::cached_user_info::CachedUserInfo;
+use pbs_config::CachedUserInfo;
 use crate::config::tfa::TfaChallenge;
 
 pub mod acl;
diff --git a/src/api2/access/openid.rs b/src/api2/access/openid.rs
index 99636e95..38fab409 100644
--- a/src/api2/access/openid.rs
+++ b/src/api2/access/openid.rs
@@ -19,7 +19,7 @@ use pbs_tools::ticket::Ticket;
 use pbs_config::domains::{OpenIdUserAttribute, OpenIdRealmConfig};
 
 use crate::server::ticket::ApiTicket;
-use crate::config::cached_user_info::CachedUserInfo;
+use pbs_config::CachedUserInfo;
 
 use pbs_config::open_backup_lockfile;
 
@@ -116,7 +116,7 @@ pub fn openid_login(
 
     if !user_info.is_active_user_id(&user_id) {
         if config.autocreate.unwrap_or(false) {
-            use crate::config::user;
+            use pbs_config::user;
             let _lock = open_backup_lockfile(user::USER_CFG_LOCKFILE, None, true)?;
             let user = User {
                 userid: user_id.clone(),
diff --git a/src/api2/access/tfa.rs b/src/api2/access/tfa.rs
index 8b0166c6..0426fcd4 100644
--- a/src/api2/access/tfa.rs
+++ b/src/api2/access/tfa.rs
@@ -9,7 +9,7 @@ use proxmox::{http_bail, http_err};
 
 use pbs_api_types::{Authid, Userid, User, PASSWORD_SCHEMA, PRIV_PERMISSIONS_MODIFY, PRIV_SYS_AUDIT};
 
-use crate::config::cached_user_info::CachedUserInfo;
+use pbs_config::CachedUserInfo;
 use crate::config::tfa::{TfaInfo, TfaUserData};
 
 /// Perform first-factor (password) authentication only. Ignore password for the root user.
@@ -34,7 +34,7 @@ fn tfa_update_auth(
 
     // After authentication, verify that the to-be-modified user actually exists:
     if must_exist && authid.user() != userid {
-        let (config, _digest) = crate::config::user::config()?;
+        let (config, _digest) = pbs_config::user::config()?;
 
         if config
             .lookup::<User>("user", userid.as_str())
diff --git a/src/api2/access/user.rs b/src/api2/access/user.rs
index 6a2fe83c..75071cf1 100644
--- a/src/api2/access/user.rs
+++ b/src/api2/access/user.rs
@@ -16,7 +16,7 @@ use pbs_api_types::{
 };
 use pbs_config::token_shadow;
 
-use crate::config::cached_user_info::CachedUserInfo;
+use pbs_config::CachedUserInfo;
 
 fn new_user_with_tokens(user: User) -> UserWithTokens {
     UserWithTokens {
@@ -59,7 +59,7 @@ pub fn list_users(
     mut rpcenv: &mut dyn RpcEnvironment,
 ) -> Result<Vec<UserWithTokens>, Error> {
 
-    let (config, digest) = crate::config::user::config()?;
+    let (config, digest) = pbs_config::user::config()?;
 
     let auth_id: Authid = rpcenv
         .get_auth_id()
@@ -138,9 +138,9 @@ pub fn create_user(
     rpcenv: &mut dyn RpcEnvironment
 ) -> Result<(), Error> {
 
-    let _lock = crate::config::user::lock_config()?;
+    let _lock = pbs_config::user::lock_config()?;
 
-    let (mut section_config, _digest) = crate::config::user::config()?;
+    let (mut section_config, _digest) = pbs_config::user::config()?;
 
     if section_config.sections.get(config.userid.as_str()).is_some() {
         bail!("user '{}' already exists.", config.userid);
@@ -153,7 +153,7 @@ pub fn create_user(
     // Fails if realm does not exist!
     let authenticator = crate::auth::lookup_authenticator(realm)?;
 
-    crate::config::user::save_config(&section_config)?;
+    pbs_config::user::save_config(&section_config)?;
 
     if let Some(password) = password {
         let user_info = CachedUserInfo::new()?;
@@ -185,7 +185,7 @@ pub fn create_user(
 )]
 /// Read user configuration data.
 pub fn read_user(userid: Userid, mut rpcenv: &mut dyn RpcEnvironment) -> Result<User, Error> {
-    let (config, digest) = crate::config::user::config()?;
+    let (config, digest) = pbs_config::user::config()?;
     let user = config.lookup("user", userid.as_str())?;
     rpcenv["digest"] = proxmox::tools::digest_to_hex(&digest).into();
     Ok(user)
@@ -253,9 +253,9 @@ pub fn update_user(
     rpcenv: &mut dyn RpcEnvironment,
 ) -> Result<(), Error> {
 
-    let _lock = crate::config::user::lock_config()?;
+    let _lock = pbs_config::user::lock_config()?;
 
-    let (mut config, expected_digest) = crate::config::user::config()?;
+    let (mut config, expected_digest) = pbs_config::user::config()?;
 
     if let Some(ref digest) = digest {
         let digest = proxmox::tools::hex_to_digest(digest)?;
@@ -317,7 +317,7 @@ pub fn update_user(
 
     config.set_data(userid.as_str(), "user", &data)?;
 
-    crate::config::user::save_config(&config)?;
+    pbs_config::user::save_config(&config)?;
 
     Ok(())
 }
@@ -345,10 +345,10 @@ pub fn update_user(
 /// Remove a user from the configuration file.
 pub fn delete_user(userid: Userid, digest: Option<String>) -> Result<(), Error> {
 
-    let _lock = crate::config::user::lock_config()?;
+    let _lock = pbs_config::user::lock_config()?;
     let _tfa_lock = crate::config::tfa::write_lock()?;
  
-    let (mut config, expected_digest) = crate::config::user::config()?;
+    let (mut config, expected_digest) = pbs_config::user::config()?;
 
     if let Some(ref digest) = digest {
         let digest = proxmox::tools::hex_to_digest(digest)?;
@@ -360,7 +360,7 @@ pub fn delete_user(userid: Userid, digest: Option<String>) -> Result<(), Error>
         None => bail!("user '{}' does not exist.", userid),
     }
 
-    crate::config::user::save_config(&config)?;
+    pbs_config::user::save_config(&config)?;
 
     let authenticator = crate::auth::lookup_authenticator(userid.realm())?;
     match authenticator.remove_password(userid.name()) {
@@ -416,7 +416,7 @@ pub fn read_token(
     mut rpcenv: &mut dyn RpcEnvironment,
 ) -> Result<ApiToken, Error> {
 
-    let (config, digest) = crate::config::user::config()?;
+    let (config, digest) = pbs_config::user::config()?;
 
     let tokenid = Authid::from((userid, Some(tokenname)));
 
@@ -482,9 +482,9 @@ pub fn generate_token(
     digest: Option<String>,
 ) -> Result<Value, Error> {
 
-    let _lock = crate::config::user::lock_config()?;
+    let _lock = pbs_config::user::lock_config()?;
 
-    let (mut config, expected_digest) = crate::config::user::config()?;
+    let (mut config, expected_digest) = pbs_config::user::config()?;
 
     if let Some(ref digest) = digest {
         let digest = proxmox::tools::hex_to_digest(digest)?;
@@ -510,7 +510,7 @@ pub fn generate_token(
 
     config.set_data(&tokenid_string, "token", &token)?;
 
-    crate::config::user::save_config(&config)?;
+    pbs_config::user::save_config(&config)?;
 
     Ok(json!({
         "tokenid": tokenid_string,
@@ -563,9 +563,9 @@ pub fn update_token(
     digest: Option<String>,
 ) -> Result<(), Error> {
 
-    let _lock = crate::config::user::lock_config()?;
+    let _lock = pbs_config::user::lock_config()?;
 
-    let (mut config, expected_digest) = crate::config::user::config()?;
+    let (mut config, expected_digest) = pbs_config::user::config()?;
 
     if let Some(ref digest) = digest {
         let digest = proxmox::tools::hex_to_digest(digest)?;
@@ -596,7 +596,7 @@ pub fn update_token(
 
     config.set_data(&tokenid_string, "token", &data)?;
 
-    crate::config::user::save_config(&config)?;
+    pbs_config::user::save_config(&config)?;
 
     Ok(())
 }
@@ -631,9 +631,9 @@ pub fn delete_token(
     digest: Option<String>,
 ) -> Result<(), Error> {
 
-    let _lock = crate::config::user::lock_config()?;
+    let _lock = pbs_config::user::lock_config()?;
 
-    let (mut config, expected_digest) = crate::config::user::config()?;
+    let (mut config, expected_digest) = pbs_config::user::config()?;
 
     if let Some(ref digest) = digest {
         let digest = proxmox::tools::hex_to_digest(digest)?;
@@ -650,7 +650,7 @@ pub fn delete_token(
 
     token_shadow::delete_secret(&tokenid)?;
 
-    crate::config::user::save_config(&config)?;
+    pbs_config::user::save_config(&config)?;
 
     Ok(())
 }
@@ -682,7 +682,7 @@ pub fn list_tokens(
     mut rpcenv: &mut dyn RpcEnvironment,
 ) -> Result<Vec<ApiToken>, Error> {
 
-    let (config, digest) = crate::config::user::config()?;
+    let (config, digest) = pbs_config::user::config()?;
 
     let list:Vec<ApiToken> = config.convert_to_typed_array("token")?;
 
diff --git a/src/api2/admin/datastore.rs b/src/api2/admin/datastore.rs
index 0863d000..5b935737 100644
--- a/src/api2/admin/datastore.rs
+++ b/src/api2/admin/datastore.rs
@@ -58,7 +58,7 @@ use crate::backup::{
     DataStore, LocalChunkReader,
 };
 use crate::config::datastore;
-use crate::config::cached_user_info::CachedUserInfo;
+use pbs_config::CachedUserInfo;
 
 use crate::server::{jobstate::Job, WorkerTask};
 
diff --git a/src/api2/admin/sync.rs b/src/api2/admin/sync.rs
index 83d5c05d..07f268b5 100644
--- a/src/api2/admin/sync.rs
+++ b/src/api2/admin/sync.rs
@@ -9,6 +9,7 @@ use proxmox::{list_subdirs_api_method, sortable};
 
 use pbs_api_types::{DATASTORE_SCHEMA, JOB_ID_SCHEMA, Authid, SyncJobConfig, SyncJobStatus};
 use pbs_config::sync;
+use pbs_config::CachedUserInfo;
 
 use crate::{
     api2::{
@@ -18,9 +19,6 @@ use crate::{
             check_sync_job_read_access,
         },
     },
-    config::{
-        cached_user_info::CachedUserInfo,
-    },
     server::{
         jobstate::{
             Job,
diff --git a/src/api2/admin/verify.rs b/src/api2/admin/verify.rs
index cc30f258..72050c04 100644
--- a/src/api2/admin/verify.rs
+++ b/src/api2/admin/verify.rs
@@ -12,6 +12,7 @@ use pbs_api_types::{
     PRIV_DATASTORE_AUDIT, PRIV_DATASTORE_VERIFY,
 };
 use pbs_config::verify;
+use pbs_config::CachedUserInfo;
 
 use crate::{
     api2::types::{
@@ -25,7 +26,6 @@ use crate::{
             compute_schedule_status,
         },
     },
-    config::cached_user_info::CachedUserInfo,
 };
 
 #[api(
diff --git a/src/api2/backup/mod.rs b/src/api2/backup/mod.rs
index 76e0e28a..cb9a859f 100644
--- a/src/api2/backup/mod.rs
+++ b/src/api2/backup/mod.rs
@@ -26,7 +26,7 @@ use pbs_datastore::manifest::{archive_type, ArchiveType};
 
 use crate::server::{WorkerTask, H2Service};
 use crate::backup::DataStore;
-use crate::config::cached_user_info::CachedUserInfo;
+use pbs_config::CachedUserInfo;
 
 mod environment;
 use environment::*;
diff --git a/src/api2/config/changer.rs b/src/api2/config/changer.rs
index 720fc6bd..5ef974a0 100644
--- a/src/api2/config/changer.rs
+++ b/src/api2/config/changer.rs
@@ -15,9 +15,9 @@ use pbs_api_types::{
     PROXMOX_CONFIG_DIGEST_SCHEMA, CHANGER_NAME_SCHEMA, SLOT_ARRAY_SCHEMA,
     PRIV_TAPE_AUDIT, PRIV_TAPE_MODIFY,
 };
+use pbs_config::CachedUserInfo;
 
 use crate::{
-    config::cached_user_info::CachedUserInfo,
     tape::{
         linux_tape_changer_list,
         check_drive_path,
diff --git a/src/api2/config/datastore.rs b/src/api2/config/datastore.rs
index 9b127115..512b59d3 100644
--- a/src/api2/config/datastore.rs
+++ b/src/api2/config/datastore.rs
@@ -24,7 +24,7 @@ use crate::api2::admin::{
     sync::list_sync_jobs,
     verify::list_verification_jobs,
 };
-use crate::config::cached_user_info::CachedUserInfo;
+use pbs_config::CachedUserInfo;
 use crate::config::datastore::{self, DataStoreConfig, DataStoreConfigUpdater};
 use crate::server::{jobstate, WorkerTask};
 
diff --git a/src/api2/config/drive.rs b/src/api2/config/drive.rs
index 74ce3cbb..703bf00a 100644
--- a/src/api2/config/drive.rs
+++ b/src/api2/config/drive.rs
@@ -8,9 +8,9 @@ use pbs_api_types::{
     Authid, LtoTapeDrive, LtoTapeDriveUpdater, ScsiTapeChanger,
     PROXMOX_CONFIG_DIGEST_SCHEMA, DRIVE_NAME_SCHEMA, PRIV_TAPE_AUDIT, PRIV_TAPE_MODIFY,
 };
+use pbs_config::CachedUserInfo;
 
 use crate::{
-    config::cached_user_info::CachedUserInfo,
     tape::{
         lto_tape_device_list,
         check_drive_path,
diff --git a/src/api2/config/media_pool.rs b/src/api2/config/media_pool.rs
index 56f86498..6782e56c 100644
--- a/src/api2/config/media_pool.rs
+++ b/src/api2/config/media_pool.rs
@@ -15,7 +15,7 @@ use pbs_api_types::{
     PRIV_TAPE_AUDIT, PRIV_TAPE_MODIFY,
 };
 
-use crate::config::cached_user_info::CachedUserInfo;
+use pbs_config::CachedUserInfo;
 
 #[api(
     protected: true,
diff --git a/src/api2/config/remote.rs b/src/api2/config/remote.rs
index 4daca23c..acf7cfcf 100644
--- a/src/api2/config/remote.rs
+++ b/src/api2/config/remote.rs
@@ -13,7 +13,7 @@ use pbs_api_types::{
 };
 use pbs_config::sync;
 
-use crate::config::cached_user_info::CachedUserInfo;
+use pbs_config::CachedUserInfo;
 
 #[api(
     input: {
diff --git a/src/api2/config/sync.rs b/src/api2/config/sync.rs
index bb2152fa..3c2bfd78 100644
--- a/src/api2/config/sync.rs
+++ b/src/api2/config/sync.rs
@@ -11,7 +11,7 @@ use pbs_api_types::{
 };
 use pbs_config::sync;
 
-use crate::config::cached_user_info::CachedUserInfo;
+use pbs_config::CachedUserInfo;
 
 pub fn check_sync_job_read_access(
     user_info: &CachedUserInfo,
@@ -356,7 +356,7 @@ pub const ROUTER: Router = Router::new()
 
 #[test]
 fn sync_job_access_test() -> Result<(), Error> {
-    let (user_cfg, _) = crate::config::user::test_cfg_from_str(r###"
+    let (user_cfg, _) = pbs_config::user::test_cfg_from_str(r###"
 user: noperm@pbs
 
 user: read@pbs
diff --git a/src/api2/config/tape_backup_job.rs b/src/api2/config/tape_backup_job.rs
index b0c41bf6..92135804 100644
--- a/src/api2/config/tape_backup_job.rs
+++ b/src/api2/config/tape_backup_job.rs
@@ -10,7 +10,7 @@ use pbs_api_types::{
     PRIV_TAPE_AUDIT, PRIV_TAPE_MODIFY,
 };
 
-use crate::config::cached_user_info::CachedUserInfo;
+use pbs_config::CachedUserInfo;
 
 #[api(
     input: {
diff --git a/src/api2/config/verify.rs b/src/api2/config/verify.rs
index 7c8946d4..7958646a 100644
--- a/src/api2/config/verify.rs
+++ b/src/api2/config/verify.rs
@@ -10,7 +10,7 @@ use pbs_api_types::{
 };
 use pbs_config::verify;
 
-use crate::config::cached_user_info::CachedUserInfo;
+use pbs_config::CachedUserInfo;
 
 #[api(
     input: {
diff --git a/src/api2/node/subscription.rs b/src/api2/node/subscription.rs
index 58e80e53..721ef40a 100644
--- a/src/api2/node/subscription.rs
+++ b/src/api2/node/subscription.rs
@@ -10,7 +10,7 @@ use pbs_api_types::{
 
 use crate::tools;
 use crate::tools::subscription::{self, SubscriptionStatus, SubscriptionInfo};
-use crate::config::cached_user_info::CachedUserInfo;
+use pbs_config::CachedUserInfo;
 
 #[api(
     input: {
diff --git a/src/api2/node/tasks.rs b/src/api2/node/tasks.rs
index 29a0ee14..e11a89be 100644
--- a/src/api2/node/tasks.rs
+++ b/src/api2/node/tasks.rs
@@ -18,7 +18,7 @@ use pbs_api_types::{
 use crate::api2::types::TaskStateType;
 use crate::api2::pull::check_pull_privs;
 use crate::server::{self, UPID, UPIDExt, TaskState, TaskListInfoIterator};
-use crate::config::cached_user_info::CachedUserInfo;
+use pbs_config::CachedUserInfo;
 
 // matches respective job execution privileges
 fn check_job_privs(auth_id: &Authid, user_info: &CachedUserInfo, upid: &UPID) -> Result<(), Error> {
diff --git a/src/api2/pull.rs b/src/api2/pull.rs
index a24f7983..d7b155a1 100644
--- a/src/api2/pull.rs
+++ b/src/api2/pull.rs
@@ -16,7 +16,7 @@ use pbs_api_types::{
 
 use crate::server::{WorkerTask, jobstate::Job, pull::pull_store};
 use crate::backup::DataStore;
-use crate::config::cached_user_info::CachedUserInfo;
+use pbs_config::CachedUserInfo;
 
 pub fn check_pull_privs(
     auth_id: &Authid,
diff --git a/src/api2/reader/mod.rs b/src/api2/reader/mod.rs
index 692eee8f..a655b6d7 100644
--- a/src/api2/reader/mod.rs
+++ b/src/api2/reader/mod.rs
@@ -37,6 +37,7 @@ use pbs_datastore::PROXMOX_BACKUP_READER_PROTOCOL_ID_V1;
 use pbs_datastore::backup_info::BackupDir;
 use pbs_datastore::index::IndexFile;
 use pbs_datastore::manifest::{archive_type, ArchiveType};
+use pbs_config::CachedUserInfo;
 
 use crate::{
     api2::helpers,
@@ -45,7 +46,6 @@ use crate::{
         WorkerTask,
         H2Service,
     },
-    config::cached_user_info::CachedUserInfo,
 };
 
 mod environment;
diff --git a/src/api2/status.rs b/src/api2/status.rs
index 7250c616..5fa3050f 100644
--- a/src/api2/status.rs
+++ b/src/api2/status.rs
@@ -22,7 +22,7 @@ use pbs_api_types::{
 use crate::backup::DataStore;
 use crate::config::datastore;
 use crate::tools::statistics::{linear_regression};
-use crate::config::cached_user_info::CachedUserInfo;
+use pbs_config::CachedUserInfo;
 
 #[api(
     returns: {
diff --git a/src/api2/tape/backup.rs b/src/api2/tape/backup.rs
index 2369d69c..39e5feea 100644
--- a/src/api2/tape/backup.rs
+++ b/src/api2/tape/backup.rs
@@ -23,9 +23,9 @@ use pbs_api_types::{
 use pbs_datastore::{task_log, task_warn, StoreProgress};
 use pbs_datastore::backup_info::{BackupDir, BackupInfo};
 use pbs_datastore::task::TaskState;
+use pbs_config::CachedUserInfo;
 
 use crate::{
-    config::cached_user_info::CachedUserInfo,
     server::{
         lookup_user_email,
         TapeBackupJobSummary,
diff --git a/src/api2/tape/changer.rs b/src/api2/tape/changer.rs
index ee2c70d7..36250788 100644
--- a/src/api2/tape/changer.rs
+++ b/src/api2/tape/changer.rs
@@ -11,9 +11,9 @@ use pbs_api_types::{
     Authid, ChangerListEntry, LtoTapeDrive, MtxEntryKind, MtxStatusEntry, ScsiTapeChanger,
     CHANGER_NAME_SCHEMA, PRIV_TAPE_AUDIT, PRIV_TAPE_READ,
 };
+use pbs_config::CachedUserInfo;
 
 use crate::{
-    config::cached_user_info::CachedUserInfo,
     tape::{
         TAPE_STATUS_DIR,
         Inventory,
diff --git a/src/api2/tape/drive.rs b/src/api2/tape/drive.rs
index 263210ee..9c8bacc3 100644
--- a/src/api2/tape/drive.rs
+++ b/src/api2/tape/drive.rs
@@ -30,9 +30,9 @@ use pbs_api_types::{
  
 use pbs_datastore::task_log;
 use pbs_api_types::{PRIV_TAPE_AUDIT, PRIV_TAPE_READ, PRIV_TAPE_WRITE};
+use pbs_config::CachedUserInfo;
 
 use crate::{
-    config::cached_user_info::CachedUserInfo,
     api2::tape::restore::{
         fast_catalog_restore,
         restore_media,
diff --git a/src/api2/tape/media.rs b/src/api2/tape/media.rs
index d669d720..72948f52 100644
--- a/src/api2/tape/media.rs
+++ b/src/api2/tape/media.rs
@@ -16,9 +16,9 @@ use pbs_api_types::{
     MediaStatus, MediaContentEntry, MediaContentListFilter,
     PRIV_TAPE_AUDIT,
 };
+use pbs_config::CachedUserInfo;
 
 use crate::{
-    config::cached_user_info::CachedUserInfo,
     tape::{
         TAPE_STATUS_DIR,
         Inventory,
diff --git a/src/api2/tape/restore.rs b/src/api2/tape/restore.rs
index 1147c3d4..24e8765f 100644
--- a/src/api2/tape/restore.rs
+++ b/src/api2/tape/restore.rs
@@ -41,10 +41,10 @@ use pbs_datastore::fixed_index::FixedIndexReader;
 use pbs_datastore::index::IndexFile;
 use pbs_datastore::manifest::{archive_type, ArchiveType, BackupManifest, MANIFEST_BLOB_NAME};
 use pbs_datastore::task::TaskState;
+use pbs_config::CachedUserInfo;
 
 use crate::{
     tools::ParallelHandler,
-    config::cached_user_info::CachedUserInfo,
     backup::DataStore,
     server::{
         lookup_user_email,
diff --git a/src/bin/docgen.rs b/src/bin/docgen.rs
index b54e4185..40c05cbf 100644
--- a/src/bin/docgen.rs
+++ b/src/bin/docgen.rs
@@ -53,7 +53,7 @@ fn main() -> Result<(), Error> {
             "datastore.cfg" => dump_section_config(&config::datastore::CONFIG),
             "tape.cfg" => dump_section_config(&pbs_config::drive::CONFIG),
             "tape-job.cfg" => dump_section_config(&pbs_config::tape_job::CONFIG),
-            "user.cfg" => dump_section_config(&config::user::CONFIG),
+            "user.cfg" => dump_section_config(&pbs_config::user::CONFIG),
             "remote.cfg" => dump_section_config(&pbs_config::remote::CONFIG),
             "sync.cfg" => dump_section_config(&pbs_config::sync::CONFIG),
             "verification.cfg" => dump_section_config(&pbs_config::verify::CONFIG),
diff --git a/src/bin/proxmox_backup_manager/acl.rs b/src/bin/proxmox_backup_manager/acl.rs
index b23943ca..8733c844 100644
--- a/src/bin/proxmox_backup_manager/acl.rs
+++ b/src/bin/proxmox_backup_manager/acl.rs
@@ -60,7 +60,7 @@ pub fn acl_commands() -> CommandLineInterface {
             "update",
             CliCommand::new(&api2::access::acl::API_METHOD_UPDATE_ACL)
                 .arg_param(&["path", "role"])
-                .completion_cb("auth-id", config::user::complete_authid)
+                .completion_cb("auth-id", pbs_config::user::complete_authid)
                 .completion_cb("path", config::datastore::complete_acl_path)
 
         );
diff --git a/src/bin/proxmox_backup_manager/user.rs b/src/bin/proxmox_backup_manager/user.rs
index b7935214..2ee15a81 100644
--- a/src/bin/proxmox_backup_manager/user.rs
+++ b/src/bin/proxmox_backup_manager/user.rs
@@ -181,38 +181,38 @@ pub fn user_commands() -> CommandLineInterface {
             "update",
             CliCommand::new(&api2::access::user::API_METHOD_UPDATE_USER)
                 .arg_param(&["userid"])
-                .completion_cb("userid", config::user::complete_userid)
+                .completion_cb("userid", pbs_config::user::complete_userid)
         )
         .insert(
             "remove",
             CliCommand::new(&api2::access::user::API_METHOD_DELETE_USER)
                 .arg_param(&["userid"])
-                .completion_cb("userid", config::user::complete_userid)
+                .completion_cb("userid", pbs_config::user::complete_userid)
         )
         .insert(
             "list-tokens",
             CliCommand::new(&&API_METHOD_LIST_TOKENS)
                 .arg_param(&["userid"])
-                .completion_cb("userid", config::user::complete_userid)
+                .completion_cb("userid", pbs_config::user::complete_userid)
         )
         .insert(
             "generate-token",
             CliCommand::new(&api2::access::user::API_METHOD_GENERATE_TOKEN)
                 .arg_param(&["userid", "tokenname"])
-                .completion_cb("userid", config::user::complete_userid)
+                .completion_cb("userid", pbs_config::user::complete_userid)
         )
         .insert(
             "delete-token",
             CliCommand::new(&api2::access::user::API_METHOD_DELETE_TOKEN)
                 .arg_param(&["userid", "tokenname"])
-                .completion_cb("userid", config::user::complete_userid)
-                .completion_cb("tokenname", config::user::complete_token_name)
+                .completion_cb("userid", pbs_config::user::complete_userid)
+                .completion_cb("tokenname", pbs_config::user::complete_token_name)
         )
         .insert(
             "permissions",
             CliCommand::new(&&API_METHOD_LIST_PERMISSIONS)
                 .arg_param(&["auth-id"])
-                .completion_cb("auth-id", config::user::complete_authid)
+                .completion_cb("auth-id", pbs_config::user::complete_authid)
                 .completion_cb("path", config::datastore::complete_acl_path)
         );
 
diff --git a/src/bin/proxmox_restore_daemon/auth.rs b/src/bin/proxmox_restore_daemon/auth.rs
index 32a8fd98..30309bb8 100644
--- a/src/bin/proxmox_restore_daemon/auth.rs
+++ b/src/bin/proxmox_restore_daemon/auth.rs
@@ -6,7 +6,7 @@ use anyhow::{bail, format_err, Error};
 
 use pbs_api_types::Authid;
 
-use proxmox_backup::config::cached_user_info::CachedUserInfo;
+use pbs_config::CachedUserInfo;
 use proxmox_backup::server::auth::{ApiAuth, AuthError};
 
 const TICKET_FILE: &str = "/ticket";
diff --git a/src/config/mod.rs b/src/config/mod.rs
index cfb114cc..ffc3b57b 100644
--- a/src/config/mod.rs
+++ b/src/config/mod.rs
@@ -15,11 +15,9 @@ use proxmox::try_block;
 use pbs_buildcfg::{self, configdir};
 
 pub mod acme;
-pub mod cached_user_info;
 pub mod datastore;
 pub mod node;
 pub mod tfa;
-pub mod user;
 
 /// Check configuration directory permissions
 ///
diff --git a/src/server/auth.rs b/src/server/auth.rs
index b5b0e0bc..c555d517 100644
--- a/src/server/auth.rs
+++ b/src/server/auth.rs
@@ -8,7 +8,7 @@ use pbs_config::token_shadow;
 
 use crate::api2::types::{Authid, Userid};
 use crate::auth_helpers::*;
-use crate::config::cached_user_info::CachedUserInfo;
+use pbs_config::CachedUserInfo;
 use crate::tools;
 
 use hyper::header;
diff --git a/src/server/email_notifications.rs b/src/server/email_notifications.rs
index f26d2cea..c81027be 100644
--- a/src/server/email_notifications.rs
+++ b/src/server/email_notifications.rs
@@ -548,7 +548,7 @@ pub fn send_updates_available(
 /// Lookup users email address
 pub fn lookup_user_email(userid: &Userid) -> Option<String> {
 
-    if let Ok(user_config) = crate::config::user::cached_config() {
+    if let Ok(user_config) = pbs_config::user::cached_config() {
         if let Ok(user) = user_config.lookup::<User>("user", userid.as_str()) {
             return user.email;
         }
diff --git a/src/server/prune_job.rs b/src/server/prune_job.rs
index 1c0d4cc0..5475d18f 100644
--- a/src/server/prune_job.rs
+++ b/src/server/prune_job.rs
@@ -6,9 +6,9 @@ use pbs_datastore::{task_log, task_warn};
 use pbs_datastore::backup_info::BackupInfo;
 use pbs_datastore::prune::{compute_prune_info, PruneOptions};
 use pbs_api_types::{Authid, PRIV_DATASTORE_MODIFY};
+use pbs_config::CachedUserInfo;
 
 use crate::{
-    config::cached_user_info::CachedUserInfo,
     backup::DataStore,
     server::jobstate::Job,
     server::WorkerTask,
diff --git a/src/server/rest.rs b/src/server/rest.rs
index 62b63a5d..48b0f8f2 100644
--- a/src/server/rest.rs
+++ b/src/server/rest.rs
@@ -40,7 +40,7 @@ use super::ApiConfig;
 
 use crate::api2::types::{Authid, Userid};
 use crate::auth_helpers::*;
-use crate::config::cached_user_info::CachedUserInfo;
+use pbs_config::CachedUserInfo;
 use crate::tools;
 use crate::tools::compression::CompressionMethod;
 use crate::tools::FileLogger;
diff --git a/src/tools/mod.rs b/src/tools/mod.rs
index 27265db6..c2bcd215 100644
--- a/src/tools/mod.rs
+++ b/src/tools/mod.rs
@@ -28,9 +28,6 @@ pub mod config;
 pub mod daemon;
 pub mod disks;
 
-mod memcom;
-pub use memcom::Memcom;
-
 pub mod serde_filter;
 pub mod statistics;
 pub mod subscription;