{
  description = "CCCB services";
  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05-small";
    flake-utils.url = "github:numtide/flake-utils";
    agenix = {
      url = "github:ryantm/agenix";
      inputs.nixpkgs.follows = "nixpkgs";
    };
  };
  outputs =
    {
      self,
      nixpkgs,
      flake-utils,
      agenix,
    }:
    let
      nixosConfigurations = {
        matrix = nixpkgs.lib.nixosSystem {
          system = "x86_64-linux";
          modules = [
            agenix.nixosModules.default
            { environment.systemPackages = [ (agenix.packages.x86_64-linux.default) ]; }
            {
              age.secrets = {
                matrix_registration_shared_secret = {
                  file = ./secrets/matrix_registration_shared_secret.age;
                  mode = "440";
                  owner = "matrix-synapse";
                  group = "matrix-synapse";
                };
                matrix_signing_key = {
                  file = ./secrets/matrix_signing_key.age;
                  mode = "440";
                  owner = "matrix-synapse";
                  group = "matrix-synapse";
                };
                matrix_db_password = {
                  file = ./secrets/matrix_db_password.age;
                  mode = "440";
                  owner = "matrix-synapse";
                  group = "matrix-synapse";
                };
                draupnir_access_token = {
                  file = ./secrets/draupnir_access_token.age;
                  mode = "440";
                  owner = "root";
                  group = "root";
                };
              };
            }
            ./hosts/matrix
          ];
        };
        md = nixpkgs.lib.nixosSystem {
          system = "x86_64-linux";
          modules = [
            agenix.nixosModules.default
            { environment.systemPackages = [ (agenix.packages.x86_64-linux.default) ]; }
            {
              age.secrets.hedgedoc_db_password = {
                file = ./secrets/hedgedoc_db_password.age;
                owner = "hedgedoc";
                group = "hedgedoc";
                mode = "0440";
              };
            }
            ./hosts/md
          ];
        };
        www = nixpkgs.lib.nixosSystem {
          system = "x86_64-linux";
          modules = [
            agenix.nixosModules.default
            { environment.systemPackages = [ (agenix.packages.x86_64-linux.default) ]; }
            {
              age.secrets = {
                www-staging-htpasswd = {
                  file = ./secrets/www-staging-htpasswd.age;
                  owner = "nginx";
                  group = "nginx";
                  mode = "0440";
                };
                caldav-export-config = {
                  file = ./secrets/caldav-export-config.age;
                  owner = "root";
                  group = "root";
                  mode = "0440";
                };
              };
            }
            ./hosts/www
          ];
        };
        monitoring = nixpkgs.lib.nixosSystem {
          system = "x86_64-linux";
          modules = [
            agenix.nixosModules.default
            { environment.systemPackages = [ (agenix.packages.x86_64-linux.default) ]; }
            {
              age.secrets = {
                grafana_secret_key = {
                  file = ./secrets/grafana_secret_key.age;
                  mode = "440";
                  owner = "grafana";
                  group = "grafana";
                };
                grafana_admin_password = {
                  file = ./secrets/grafana_admin_password.age;
                  mode = "440";
                  owner = "grafana";
                  group = "grafana";
                };
                grafana_basic_auth = {
                  file = ./secrets/grafana_basic_auth.age;
                  mode = "440";
                  owner = "nginx";
                  group = "nginx";
                };
                postgres-grafana = {
                  file = ./secrets/postgres-grafana.age;
                  mode = "440";
                  owner = "grafana";
                  group = "grafana";
                };
                pve-exporter = {
                  file = ./secrets/pve-exporter.age;
                  mode = "440";
                  owner = "prometheus";
                  group = "prometheus";
                };
              };
            }
            ./hosts/monitoring
          ];
        };
        sql = nixpkgs.lib.nixosSystem {
          system = "x86_64-linux";
          modules = [
            agenix.nixosModules.default
            { environment.systemPackages = [ (agenix.packages.x86_64-linux.default) ]; }
            {
              age.secrets = {
                postgres-matrix-synapse = {
                  file = ./secrets/postgres-matrix-synapse.age;
                  owner = "postgres";
                  group = "postgres";
                  mode = "0400";
                };
                postgres-hedgedoc = {
                  file = ./secrets/postgres-hedgedoc.age;
                  owner = "postgres";
                  group = "postgres";
                  mode = "0400";
                };
                postgres-grafana = {
                  file = ./secrets/postgres-grafana.age;
                  owner = "postgres";
                  group = "postgres";
                  mode = "0400";
                };
                postgres-forgejo = {
                  file = ./secrets/postgres-forgejo.age;
                  owner = "postgres";
                  group = "postgres";
                  mode = "0400";
                };
                postgres-baikal = {
                  file = ./secrets/postgres-baikal.age;
                  owner = "postgres";
                  group = "postgres";
                  mode = "0400";
                };
              };
            }
            ./hosts/sql
          ];
        };
        dav = nixpkgs.lib.nixosSystem {
          system = "x86_64-linux";
          modules = [
            agenix.nixosModules.default
            { environment.systemPackages = [ (agenix.packages.x86_64-linux.default) ]; }
            {
              age.secrets = {
                #radicale-htpasswd = {
                #  file = ./secrets/radicale_htpasswd.age;
                #  owner = "radicale";
                #  group = "radicale";
                #  mode = "0400";
                #};
              };
            }
            ./hosts/dav
          ];
        };
        git = nixpkgs.lib.nixosSystem {
          system = "x86_64-linux";
          modules = [
            agenix.nixosModules.default
            { environment.systemPackages = [ (agenix.packages.x86_64-linux.default) ]; }
            {
              age.secrets = {
                postgres-forgejo = {
                  file = ./secrets/postgres-forgejo.age;
                  owner = "forgejo";
                  group = "forgejo";
                  mode = "0400";
                };
                forgejo-internal-token = {
                  file = ./secrets/forgejo-internal-token.age;
                  owner = "forgejo";
                  group = "forgejo";
                  mode = "0440";
                };
                forgejo-secret-key = {
                  file = ./secrets/forgejo-secret-key.age;
                  owner = "forgejo";
                  group = "forgejo";
                  mode = "0440";
                };
                forgejo-oauth2-jwt-secret = {
                  file = ./secrets/forgejo-oauth2-jwt-secret.age;
                  owner = "forgejo";
                  group = "forgejo";
                  mode = "0440";
                };
                forgejo-runner-token-snowden = {
                  file = ./secrets/forgejo-runner-token-snowden.age;
                  owner = "root";
                  group = "root";
                  mode = "0444";
                };
                forgejo-runner-token-snowden-env = {
                  file = ./secrets/forgejo-runner-token-snowden-env.age;
                  owner = "root";
                  group = "root";
                  mode = "0444";
                };
              };
            }
            ./hosts/git
          ];
        };
        forgejo-runner = nixpkgs.lib.nixosSystem {
          system = "x86_64-linux";
          modules = [
            agenix.nixosModules.default
            { environment.systemPackages = [ (agenix.packages.x86_64-linux.default) ]; }
            {
              age.secrets = {
                forgejo-runner-token = {
                  file = ./secrets/forgejo-runner-token-snowden.age;
                  owner = "root";
                  group = "root";
                  mode = "0444";
                };
                forgejo-runner-token-env = {
                  file = ./secrets/forgejo-runner-token-snowden-env.age;
                  owner = "root";
                  group = "root";
                  mode = "0444";
                };
              };
            }
            ./hosts/forgejo-runner
          ];
        };
      };
    in
    (flake-utils.lib.eachDefaultSystem (
      system:
      let
        pkgs = import nixpkgs { inherit system; };
        remoteDiffApps = nixpkgs.lib.mapAttrs' (hostname: _: {
          name = "remote-diff-${hostname}";
          value = {
            meta.description = "Build ${hostname} locally and compare remotely to current system";
            type = "app";
            program = "${pkgs.writeShellScript "remote-diff-${hostname}.sh" ''
              set -euo pipefail
              result=$(NIX_SSHOPTS="-o VisualHostKey=no" \
                ${pkgs.nixos-rebuild}/bin/nixos-rebuild build \
                --flake ${self}#${hostname} \
                --target-host ${hostname} \
                --use-substitutes \
                --log-format internal-json -v 2> >(${pkgs.nix-output-monitor}/bin/nom --json))
              ${pkgs.openssh}/bin/ssh -t ${hostname} \
                nix run nixpkgs#nvd -- diff /run/current-system "$result"
            ''}";
          };
        }) nixosConfigurations;
        remoteApplyApps = nixpkgs.lib.mapAttrs' (hostname: _: {
          name = "remote-apply-${hostname}";
          value = {
            meta.description = "Build ${hostname} locally and apply remotely";
            type = "app";
            program = "${pkgs.writeShellScript "remote-apply-${hostname}.sh" ''
              set -euo pipefail
              NIX_SSHOPTS="-o VisualHostKey=no" \
                ${pkgs.nixos-rebuild}/bin/nixos-rebuild switch \
                --flake ${self}#${hostname} \
                --target-host ${hostname} \
                --use-substitutes \
                --log-format internal-json -v \
              |& ${pkgs.nix-output-monitor}/bin/nom --json
            ''}";
          };
        }) nixosConfigurations;
      in
      {
        formatter = pkgs.nixfmt-tree;
        apps = {
          deploy = {
            meta.description = "Deploy a NixOS configuration to a remote host";
            type = "app";
            program = "${pkgs.writeShellScript "deploy.sh" ''
              set -e
              host="''${1:?usage: nix run .#deploy -- <host>}"
              ${pkgs.openssh}/bin/ssh -tt "$host" 'bash -s' <<'EOF'
              set -e
              cd /etc/nixos
              nix run .#nixos-diff && nixos-rebuild switch
              EOF
            ''}";
          };
        }
        // remoteDiffApps
        // remoteApplyApps;
        devShells.default = pkgs.mkShell {
          packages = [
            agenix.packages.${system}.default
            pkgs.age
          ];
        };
      }
    ))
    // {
      inherit nixosConfigurations;
    };
}