{
  description = "C3D2 NixOS configurations";

  inputs = {
    nixpkgs.url = "github:nixos/nixpkgs/release-22.05";
    nixpkgs-mobilizon.url = "github:minijackson/nixpkgs/mobilizon";
    nixpkgs-openwebrx.url = "github:astro/nixpkgs/openwebrx";
    nixpkgs-master.url = "github:nixos/nixpkgs";
    secrets = {
      url = "git+ssh://gitea@gitea.c3d2.de/c3d2-admins/secrets.git";
      inputs = {
        nixpkgs.follows = "nixpkgs";
        sops-nix.follows = "sops-nix";
      };
    };
    nixos-hardware.url = "github:nixos/nixos-hardware";
    zentralwerk = {
      url = "git+https://gitea.c3d2.de/zentralwerk/network.git";
      inputs = {
        nixpkgs.follows = "nixpkgs";
        nixpkgs-master.follows = "nixpkgs-master";
      };
    };
    yammat.url = "git+https://gitea.c3d2.de/astro/yammat.git?ref=nix";
    yammat.inputs.nixpkgs.follows = "nixpkgs";
    scrapers.url = "git+https://gitea.c3d2.de/astro/scrapers.git";
    scrapers.flake = false;
    spacemsg.url = "github:astro/spacemsg";
    spacemsg.flake = false;
    tigger.url = "github:astro/tigger";
    tigger.flake = false;
    ticker = {
      url = "git+https://gitea.c3d2.de/astro/ticker.git";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    heliwatch = {
      url = "git+https://gitea.c3d2.de/astro/heliwatch.git";
      inputs = {
        fenix.follows = "fenix";
        nixpkgs.follows = "nixpkgs";
        naersk.follows = "naersk";
      };
    };
    sops-nix = {
      url = "github:Mic92/sops-nix";
      inputs = {
        nixpkgs.follows = "nixpkgs";
      };
    };
    naersk.url = "github:nix-community/naersk";
    naersk.inputs.nixpkgs.follows = "nixpkgs";
    fenix.url = "github:nix-community/fenix";
    fenix.inputs.nixpkgs.follows = "nixpkgs";
    hydra = {
      url = "github:nixos/hydra";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    microvm.url = "github:astro/microvm.nix";
  };

  outputs = inputs@{ self, nixpkgs, secrets, nixos-hardware, zentralwerk, yammat, scrapers, spacemsg, tigger, ticker, heliwatch, sops-nix, naersk, fenix, microvm, ... }:
    let
      inherit (nixpkgs) lib;
      forAllSystems = lib.genAttrs [ "aarch64-linux" "x86_64-linux" ];

      extractZwHosts = { hosts4, hosts6, ... }:
        lib.recursiveUpdate (
          builtins.foldl' (result: name:
            lib.recursiveUpdate result {
              "${name}".ip4 = hosts4."${name}";
            }
          ) {} (builtins.attrNames hosts4)
        ) (
          builtins.foldl' (result: ctx:
            builtins.foldl' (result: name:
              lib.recursiveUpdate result {
                "${name}".ip6 = hosts6."${ctx}"."${name}";
              }
            ) result (builtins.attrNames hosts6."${ctx}")
          ) {} (builtins.attrNames hosts6)
        );
      zwHostRegistry = {
        hosts =
          builtins.foldl' (result: net:
            lib.recursiveUpdate result (extractZwHosts zentralwerk.lib.config.site.net."${net}")
          ) {} [ "core" "c3d2" "serv" ];
      };
      extraHostRegistry.hosts = import ./host-registry.nix;
      hostRegistry = lib.recursiveUpdate zwHostRegistry extraHostRegistry;

      getHostAddr = name:
        let
          hostConf = hostRegistry.hosts."${name}";
        in
          if hostConf ? ip4
          then hostConf.ip4
          else if hostConf ? ip6
          then hostConf.ip6
          else throw "Host ${name} has no ip4 or ip6 address";
    in {
      overlay = import ./overlay;

      legacyPackages = lib.attrsets.mapAttrs
        (system: pkgs: pkgs.appendOverlays
          [ fenix.overlay naersk.overlay self.overlay ])
        nixpkgs.legacyPackages;

      packages = lib.attrsets.mapAttrs (system: pkgs:
        let overlayPkgs = builtins.intersectAttrs (self.overlay {} {}) pkgs;
        in overlayPkgs //
        {

          list-upgradable = pkgs.writeScriptBin "list-upgradable" ''
            #! ${pkgs.runtimeShell}

            NORMAL="\033[0m"
            RED="\033[0;31m"
            YELLOW="\033[0;33m"
            GREEN="\033[0;32m"

            ${pkgs.lib.concatMapStringsSep "\n" (name:
              let
                addr = getHostAddr name;
              in nixpkgs.lib.optionalString (addr != null) ''
                echo -n -e "${name}: $RED"
                RUNNING=$(ssh -o PreferredAuthentications=publickey -o StrictHostKeyChecking=accept-new root@"${addr}" "readlink /run/current-system")
                if [ $? = 0 ] && [ -n "$RUNNING" ]; then
                  CURRENT=$(nix eval --raw ".#nixosConfigurations.${name}.config.system.build.toplevel" 2>/dev/null)
                  RUNNING_VER=$(basename $RUNNING|rev|cut -d - -f 1|rev)
                  RUNNING_DATE=$(echo $RUNNING_VER|cut -d . -f 3)
                  CURRENT_VER=$(basename $CURRENT|rev|cut -d - -f 1|rev)
                  CURRENT_DATE=$(echo $CURRENT_VER|cut -d . -f 3)

                  if [ "$RUNNING" = "$CURRENT" ]; then
                    echo -e "$GREEN"current"$NORMAL $RUNNING_VER"
                  elif [ $RUNNING_DATE -gt $CURRENT_DATE ]; then
                    echo -e "$GREEN"newer"$NORMAL $RUNNING_VER > $CURRENT_VER"
                  elif [ "$RUNNING_VER" = "$CURRENT_VER" ]; then
                    echo -e "$YELLOW"modified"$NORMAL $RUNNING_VER"
                  elif [ -n "$RUNNING_VER" ]; then
                    echo -e "$RED"outdated"$NORMAL $RUNNING_VER < $CURRENT_VER"
                  else
                    echo -e "$RED"error"$NORMAL $RUNNING_VER"
                  fi
                fi
                echo -n -e "$NORMAL"
              '') (builtins.attrNames self.nixosConfigurations)}
          '';

          prebuild-all = pkgs.runCommandNoCC "prebuild-all" {
            preferLocalBuild = true;
          } ''
            mkdir $out

            ${pkgs.lib.concatMapStrings (name: ''
              ln -s ${self.nixosConfigurations."${name}".config.system.build.toplevel} name
            '') (builtins.attrNames self.nixosConfigurations)}
          '';

          prebuild-all-remote = pkgs.writeScriptBin "prebuild-all" ''
            #!${pkgs.runtimeShell} -e

            nix copy --to ssh://$1 ${secrets}
            nix copy --to ssh://$1 ${self}

            set -x
            ssh $1 -- nix build -vL --no-link ${
              pkgs.lib.concatMapStringsSep " " (name:
                "${self}#nixosConfigurations.${name}.config.system.build.toplevel"
              ) (builtins.attrNames self.nixosConfigurations)
            }
          '';

        } //

        builtins.foldl' (result: host: result // {
          # TODO: check if the ethernet address is reachable and if not,
          # execute wol on a machine in HQ.
          "${host}-wake" = pkgs.writeScriptBin "${host}-wake" ''
            #!${pkgs.runtimeShell}
            exec ${pkgs.wol}/bin/wol ${hostRegistry.hosts."${host}".ether}
          '';
        }) {} (builtins.attrNames (nixpkgs.lib.filterAttrs (_: { wol ? false, ... }: wol) hostRegistry.hosts)) //

        builtins.foldl' (result: name:
          let
            host = getHostAddr name;
            target = ''root@"${host}"'';
            rebuildArg = "--flake ${self}#${name}";
            profile = self.nixosConfigurations."${name}".config.system.build.toplevel;
          in result // {
            # Generate a small script for copying this flake to the
            # remote machine and bulding and switching there.
            # Can be run with `nix run c3d2#…-nixos-rebuild switch`
            "${name}-nixos-rebuild" = pkgs.writeScriptBin "${name}-nixos-rebuild" ''
              #!${pkgs.runtimeShell} -ex
              [[ $(ssh ${target} cat /etc/hostname) == ${name} ]]
              nix copy --to ssh://${target} ${secrets}
              nix copy --to ssh://${target} ${self}
              ssh ${target} nixos-rebuild ${rebuildArg} "$@"
            '';

            "${name}-nixos-rebuild-local" = pkgs.writeScriptBin "${name}-nixos-rebuild" ''
               #!${pkgs.runtimeShell} -ex
               [[ $(ssh ${target} cat /etc/hostname) == ${name} ]]
               nix copy --to ssh://${target} ${profile}
               ssh ${target} "${profile}/bin/switch-to-configuration $*"
            '';

            "${name}-cleanup" = pkgs.writeScriptBin "${name}-cleanup" ''
              #!${pkgs.runtimeShell} -ex
              ssh ${target} "time nix-collect-garbage -d && time nix-store --optimise"
            '';
          }) {} (builtins.attrNames self.nixosConfigurations) //

        builtins.foldl' (result: host:
          let
            inherit (self.nixosConfigurations.${host}) config;
          in
            result //
            nixpkgs.lib.optionalAttrs (config.system.build ? sdImage) {
              "${host}-sdImage" = config.system.build.sdImage;
            } //
            nixpkgs.lib.optionalAttrs (config.system.build ? vm) {
              # boot any machine in a microvm
              "${host}-vm" = (self.nixosConfigurations.${host}
                .extendModules {
                  modules = [
                    microvm.nixosModules.microvm
                    {
                      microvm = {
                        mem = 2048;
                        hypervisor = "qemu";
                        socket = null;
                        shares = [ {
                          tag = "ro-store";
                          source = "/nix/store";
                          mountPoint = "/nix/.ro-store";
                        } ];
                      };
                      boot.isContainer = lib.mkForce false;
                      users.users.root.password = "";
                      fileSystems."/".fsType = lib.mkForce "tmpfs";
                      services.getty.helpLine = ''
                        Log in as "root" with an empty password.
                        Use "reboot" to shut qemu down.
                      '';
                    }
                  ];
                })
                .config.microvm.declaredRunner;
            } //
            nixpkgs.lib.optionalAttrs (config.system.build ? tftproot) {
              "${host}-tftproot" = config.system.build.tftproot;
            }
        ) {} (builtins.attrNames self.nixosConfigurations)
      ) self.legacyPackages;

      nixosConfigurations = let
        nixosSystem' =
          # Our custom NixOS builder
          { nixpkgs ? inputs.nixpkgs, modules, extraArgs ? {}, system ? "x86_64-linux" }:
          nixpkgs.lib.nixosSystem {
            inherit system;

            modules = [
              ({ pkgs, ... }: {
                _module.args = extraArgs // {
                  inherit hostRegistry inputs zentralwerk;
                };
                nixpkgs = {
                  overlays = [ self.overlay ];
                };
              })

              self.nixosModules.c3d2
              ./config/audio-server
              ./config/c3d2.nix
              ./config/cache.nix
              ./config/ceph-storage.nix
              ./config/stats.nix
              ./modules/pi-sensors.nix
            ] ++ modules;

          };
      in {

        freifunk = nixosSystem' {
          modules = [
            ./hosts/containers/freifunk
            {
              nixpkgs.overlays = with secrets.overlays; [
                freifunk ospf
              ];
              sops.defaultSopsFile = "${secrets}/hosts/freifunk/secrets.yaml";
            }
          ];
        };

        gitea = nixosSystem' {
          nixpkgs = inputs.nixpkgs-master;
          modules = [
            ./config/lxc-container.nix
            ./hosts/containers/gitea
          ];
        };

        glotzbert = nixosSystem' {
          modules = [
            ./hosts/glotzbert
            nixos-hardware.nixosModules.common-cpu-intel
            nixos-hardware.nixosModules.common-pc-ssd
            secrets.nixosModules.admins
            {
              sops.defaultSopsFile = "${secrets}/hosts/glotzbert/secrets.yaml";
            }
          ];
        };

        nix-build = nixosSystem' {
          modules = [
            ./hosts/containers/nix-build
          ];
          extraArgs.tftproots = nixpkgs.lib.filterAttrs (name: _:
            builtins.match ".+-tftproot" name != null
          ) self.packages.x86_64-linux;
        };

        pulsebert = nixosSystem' {
          modules = [
            "${inputs.nixpkgs}/nixos/modules/installer/sd-card/sd-image-aarch64.nix"
            ./hosts/pulsebert
          ];
          system = "aarch64-linux";
        };

        radiobert = nixosSystem' {
          modules = [
            ({ modulesPath, ... }:
            {
              imports = [ "${modulesPath}/installer/sd-card/sd-image-aarch64.nix" ];
              nixpkgs.overlays = [ heliwatch.overlay ];
              sops.defaultSopsFile = "${secrets}/hosts/radiobert/secrets.yaml";
            })
            ./hosts/radiobert
          ];
          system = "aarch64-linux";
        };

        nncp = nixosSystem' {
          nixpkgs = inputs.nixpkgs-master;
          modules = [
            self.nixosModules.nncp
            ./config/lxc-container.nix
            ./hosts/containers/nncp
          ];
        };

        dacbert = nixosSystem' {
          modules = [
            nixos-hardware.nixosModules.raspberry-pi-4
            self.nixosModules.rpi-netboot
            ./hosts/dacbert
          ];
          system = "aarch64-linux";
        };

        rpi-netboot = nixosSystem' {
          extraArgs = { inherit nixpkgs; };
          modules = [
            nixos-hardware.nixosModules.raspberry-pi-4
            self.nixosModules.rpi-netboot
            ./hosts/rpi-netboot
          ];
          system = "aarch64-linux";
        };

        matemat = nixosSystem' {
          modules = [
            ./config/lxc-container.nix
            ./hosts/containers/matemat
            yammat.nixosModule
            secrets.nixosModules.admins
            { nixpkgs.overlays = [ secrets.overlays.matemat ]; }
          ];
        };

        scrape = nixosSystem' {
          modules = [
            ./config/lxc-container.nix
            ./hosts/containers/scrape
            { nixpkgs.overlays = [ secrets.overlays.scrape ]; }
          ];
          extraArgs = { inherit scrapers; };
        };

        dn42 = nixosSystem' {
          modules = [
            ./config/lxc-container.nix
            ./hosts/containers/dn42
            {
              nixpkgs.overlays = [ secrets.overlays.dn42 ];
              sops.defaultSopsFile = "${secrets}/hosts/dn42/secrets.yaml";
            }
          ];
        };

        grafana = nixosSystem' {
          modules = [
            ./config/lxc-container.nix
            ./hosts/containers/grafana
          ];
        };

        hydra = nixosSystem' {
          modules = [
            inputs.hydra.nixosModules.hydra
            ./hosts/hydra
            {
              sops.defaultSopsFile = "${secrets}/hosts/hydra/secrets.yaml";
            }
          ];
        };

        mucbot = nixosSystem' {
          modules = [
            ./config/lxc-container.nix
            "${tigger}/module.nix"
            { nixpkgs.overlays = [ secrets.overlays.mucbot ]; }
            ./hosts/containers/mucbot
          ];
          extraArgs = { inherit tigger; };
        };

        kibana = nixosSystem' {
          modules = [
            ./config/lxc-container.nix
            ./hosts/containers/kibana
          ];
        };

        public-access-proxy = nixosSystem' {
          modules = [
            ./config/lxc-container.nix
            ./hosts/containers/public-access-proxy
          ];
          extraArgs = {
            inherit (self) nixosConfigurations;
          };
        };

        ticker = nixosSystem' {
          modules = [
            ./config/lxc-container.nix
            "${ticker}/nixos-module.nix"
            ./hosts/containers/ticker
          ];
        };

        spaceapi = nixosSystem' {
          modules = [
            ./config/lxc-container.nix
            "${spacemsg}/spaceapi/module.nix"
            ./hosts/containers/spaceapi
          ];
        };

        stream = nixosSystem' {
          modules = [
            ./config/lxc-container.nix
            ./hosts/containers/stream
          ];
        };

        mobilizon = nixosSystem' {
          # TODO: pending https://github.com/NixOS/nixpkgs/pull/119132
          nixpkgs = inputs.nixpkgs-mobilizon;
          modules = [
            ./config/lxc-container.nix
            ./hosts/containers/mobilizon
          ];
        };

        mail = nixosSystem' {
          modules = [
            ./config/lxc-container.nix
            ./hosts/containers/mail
          ];
        };

        logging = nixosSystem' {
          modules = [
            ./config/lxc-container.nix
            ./hosts/containers/logging
          ];
        };

        keycloak = nixosSystem' {
          modules = [
            ./config/lxc-container.nix
            ./hosts/containers/keycloak
            { nixpkgs.overlays = with secrets.overlays; [ keycloak ]; }
          ];
        };

        c3d2-web = nixosSystem' {
          nixpkgs = inputs.nixpkgs-master;
          modules = [
            ./config/lxc-container.nix
            ./hosts/containers/c3d2-web
            { nixpkgs.overlays = [ secrets.overlays.c3d2-web ]; }
          ];
          extraArgs = {
            inherit nixpkgs;
          };
        };

        sdrweb = nixosSystem' {
          nixpkgs = inputs.nixpkgs-openwebrx;
          modules = [
            ./config/lxc-container.nix
            { nixpkgs.overlays = [ secrets.overlays.mucbot ]; }
            heliwatch.nixosModules.heliwatch
            ./hosts/containers/sdrweb
          ];
        };

        bind = nixosSystem' {
          modules = [
            { nixpkgs.overlays = with secrets.overlays; [ bind ]; }
            ./config/lxc-container.nix
            ./hosts/containers/bind
          ];
        };

        jabber = nixosSystem' {
          modules = [
            { nixpkgs.overlays = with secrets.overlays; [ jabber ]; }
            ./config/lxc-container.nix
            ./hosts/containers/jabber
          ];
        };

        storage-ng = nixosSystem' {
          modules = [
            ./hosts/storage-ng
            secrets.nixosModules.admins
            { sops.defaultSopsFile = "${secrets}/hosts/storage-ng/secrets.yaml"; }
          ];
        };

        blogs = nixosSystem' {
          modules = [
            self.nixosModules.plume
            ./config/lxc-container.nix
            ./hosts/containers/blogs
            { sops.defaultSopsFile = "${secrets}/hosts/blogs/secrets.yaml"; }
          ];
        };

        server10 = nixosSystem' {
          modules = [
            ./hosts/server10
            microvm.nixosModules.host
          ];
        };

      };

      nixosModule = self.nixosModules.c3d2;
      nixosModules = {
        c3d2 = {
          imports = [
            sops-nix.nixosModule
            ./modules/c3d2.nix
            ./modules/nncp.nix
            ./modules/autoupdate.nix
          ];
          c3d2.hosts = hostRegistry.hosts;
          c3d2.users = import ./users.nix;
          c3d2.nncp.neigh = import ./config/nncp-relays.nix;
        };
        nncp = ./modules/nncp.nix;
        plume = {
          imports = [ ./modules/plume.nix ];
          nixpkgs.overlays = [ fenix.overlay naersk.overlay ];
        };
        rpi-netboot = ./modules/rpi-netboot.nix;
      };

      hydraJobs = forAllSystems (system:
        builtins.mapAttrs (_: nixpkgs.lib.hydraJob) (
          nixpkgs.lib.filterAttrs (_: toplevel:
            system == toplevel.system
          ) (builtins.mapAttrs (_: nixosSystem:
            nixosSystem.config.system.build.toplevel
          ) self.nixosConfigurations)
          //
          nixpkgs.lib.filterAttrs (name: _:
            builtins.match ".+-tftproot" name != null
          ) self.packages.${system}
        )
      );
    };
}