{
  description = "computer systems infrastructure";

  inputs = {
    nixpkgs.url = "github:nixos/nixpkgs/nixos-24.05";

    flake-parts.url = "github:hercules-ci/flake-parts";

    sops-nix.url = "github:Mic92/sops-nix";
    sops-nix.inputs.nixpkgs.follows = "nixpkgs";

    disko.url = "github:nix-community/disko";
    disko.inputs.nixpkgs.follows = "nixpkgs";

    deploy-rs.url = "github:serokell/deploy-rs";
    deploy-rs.inputs.nixpkgs.follows = "nixpkgs";

    impermanence.url = "github:nix-community/impermanence";

    min-rip.url = "git+ssh://git@git.min.rip/min/min.rip.git";
    min-rip.flake = false;

    breeze.url = "git+https://git.min.rip/min/breeze.git";
    breeze.inputs.nixpkgs.follows = "nixpkgs";
  };

  outputs = inputs @ {self, ...}:
    inputs.flake-parts.lib.mkFlake {inherit inputs;} {
      flake = let
        hosts = import ./nixos/hosts {inherit inputs;};
      in {
        inherit (hosts) nixosConfigurations deploy;
      };

      systems = ["x86_64-linux"];

      perSystem = {
        system,
        pkgs,
        ...
      }: {
        devShells.default = pkgs.mkShell {
          KUSTOMIZE_PLUGIN_HOME = pkgs.buildEnv {
            name = "kustomize-plugins";
            paths = with pkgs; [
              kustomize-sops
            ];
            postBuild = ''
              mv $out/lib/* $out
              rm -r $out/lib
            '';
            pathsToLink = ["/lib"];
          };

          packages = with pkgs; [
            sops
            ssh-to-age
            # not included: age, gpg, pcscd, scdaemon, etc.

            deploy-rs
            nixos-anywhere

            argocd
            kubectl
            kustomize
            kubernetes-helm

            yamllint

            nil
            alejandra
            statix
            deadnix
          ];
        };
      };
    };
}