{
# Pin down nixpkgs from github, instead of using global, system or user registries.
inputs.nixpkgs.url = "github:NixOS/nixpkgs/8afc4e543663ca0a6a4f496262cd05233737e732";
#inputs.nixpkgs.url = "flake:nixpkgs";
inputs.flake-utils.url = "github:numtide/flake-utils";
inputs.home-manager.follows = "julm-nix/home-manager";
#inputs.julm-nix.url = "git+https://git.hut.sourcephile.fr/~julm/julm-nix?ref=main";
inputs.julm-nix.url = "git+file:///home/julm/work/sourcephile/nix/julm-nix?ref=main";
inputs.julm-nix.inputs.flake-utils.follows = "flake-utils";
inputs.julm-nix.inputs.nixpkgs.follows = "nixpkgs";
inputs.doom-emacs.follows = "julm-nix/doom-emacs";
inputs.nix-doom-emacs.follows = "julm-nix/nix-doom-emacs";
inputs.nix-doom-emacs.inputs.doom-emacs.follows = "julm-nix/doom-emacs";
inputs.emacs-overlay.follows = "julm-nix/emacs-overlay";
#inputs.shell = { type = "path"; path = "./shell"; flake = false; };
#inputs.secrets = { type = "path"; path = "./sec"; flake = false; };
#inputs.pass = { type = "path"; path = "./pass"; flake = false; };
inputs.shell.url = "path:./shell";
inputs.shell.flake = false;
inputs.secrets.type = "path";
inputs.secrets.path = "/home/julm/work/sourcephile/nix/sec";
inputs.secrets.flake = false;
inputs.pass.type = "path";
inputs.pass.path = "/home/julm/work/sourcephile/nix/pass";
inputs.pass.flake = false;

outputs = inputs: let
  remoteNixpkgsPatches = import nixpkgs/patches.nix;
  localNixpkgsPatches = [
    nixpkgs/patches/sourcehut.diff
    nixpkgs/patches/systemd-coredump.diff
  ];
  originPkgs = inputs.nixpkgs.legacyPackages."x86_64-linux";
  nixpkgs = originPkgs.applyPatches {
    name = "nixpkgs-patched";
    src = inputs.nixpkgs;
    patches = map originPkgs.fetchpatch remoteNixpkgsPatches ++ localNixpkgsPatches;
    postPatch = ''
      patch=$(printf '%s\n' ${builtins.concatStringsSep " "
         (map (p: p.sha256) remoteNixpkgsPatches ++ localNixpkgsPatches)} |
        sort | sha256sum | cut -c -7)
      echo "+patch-$patch" >.version-suffix
    '';
  };
  lib = originPkgs.lib;
  hosts = builtins.mapAttrs (hostName: hostConfig:
    let cfg = import hostConfig { inherit inputs hostName; }; in
    import (nixpkgs + "/nixos/lib/eval-config.nix") (cfg // {
      specialArgs = {
        inherit hostName inputs;
        private = "/root/private"; # Kept out of /nix/store
      };
      extraArgs = {
        hosts = inputs.self.nixosConfigurations;
        host = inputs.self.nixosConfigurations.${hostName}.extraArgs;
      } // (cfg.extraArgs or {});
      modules = cfg.modules ++ [
        inputs.home-manager.nixosModules.home-manager
        {
          home-manager.useGlobalPkgs = true;
          home-manager.useUserPackages = true;
          home-manager.verbose = true;
          home-manager.backupFileExtension = null;
          home-manager.extraSpecialArgs = {
            inherit hostName inputs;
          };
        }
        ({ pkgs, ... }: {
          nix.package = pkgs.nixUnstable;
          nixpkgs.overlays =
            import nixpkgs/overlays.nix ++
            import (inputs.julm-nix + "/nixpkgs/overlays.nix");
          system.nixos.versionSuffix = ".${
            lib.substring 0 8 (inputs.self.lastModifiedDate or inputs.self.lastModified)}.${
            inputs.self.shortRev or "dirty"}";
          system.nixos.revision = lib.mkIf (inputs.self ? rev) inputs.self.rev;
          # Let 'nixos-version --json' know about the Git revision of this flake.
          system.configurationRevision = lib.mkIf (inputs.self ? rev) inputs.self.rev;
          security.gnupg.agent.enable = true;
          security.gnupg.store = inputs.pass + "/hosts/${hostName}";
          /*
          system.configurationRevision =
            if inputs.self ? rev
            then inputs.self.rev
            else throw "Refusing to build from a dirty Git tree!";
          */
          programs.ssh.knownHosts = {
            carotte = {
              hostNames = [ "carotte" "carotte.sourcephile.fr" ];
              publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKnnS0w9zm5KuWwlfJu+qEXC0asESQySPp76szyMTE3J";
            };
            mermet = {
              hostNames = [ "mermet" "mermet.sourcephile.fr" ];
              publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFvKN2sIpH782MFjaOpcty1Hs/T/TPNJpXI08H3O3oxl";
            };
            losurdo = {
              hostNames = [ "losurdo" "losurdo.sourcephile.fr" ];
              publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHJkAq1T0Dxozt4RPylvWrUmeuejiG+n/owb3ucnWP9F";
            };
          };
        })
      ];
    }));
  in
  {
    # Example: nix -L build .#nixosConfigurations.losurdo.config.system.build.toplevel
    # Example: nix -L build .#nixosConfigurations.losurdo.config.boot.kernelPackages.kernel.configfile
    # Example: nix -L build .#nixosConfigurations.losurdo.pkgs.hello
    # Example: nix eval .#nixosConfigurations.losurdo.config.networking.hostName
    nixosConfigurations = hosts {
      carotte = hosts/carotte.nix;
      losurdo = hosts/losurdo.nix;
      mermet  = hosts/mermet.nix;
    };
    #nixosModule = import nixos/modules.nix;
  }
  // inputs.flake-utils.lib.eachDefaultSystem (system:
    #let pkgs = inputs.nixpkgs.legacyPackages.${system}; in
    let
      pkgs = import nixpkgs {
        inherit system;
        overlays =
          import nixpkgs/overlays.nix ++
          import (inputs.julm-nix + "/nixpkgs/overlays.nix");
      };
    in {
    legacyPackages = pkgs;
    devShell = import ./shell.nix { inherit inputs pkgs; };
    apps = builtins.mapAttrs (hostName: { config, ... }: let
      build = config.system.build;
      target = "\"\${TARGET:-root@${config.networking.hostName}.${config.networking.domain}}\"";
      profile = "/nix/var/nix/profiles/system";
      in rec {
      # Example: nix run .#losurdo.switch
      "switch" = {
        type = "app";
        program = (pkgs.writeShellScript "switch" (''
          set -eux
          set -o pipefail
          nix-store --add-root hosts/${hostName}.root --indirect --realise ${build.toplevel}
          nix copy --to ssh://${target} --substitute-on-destination ${build.toplevel}
          ${sendkeys.program}
          '' + lib.optionalString config.boot.initrd.network.ssh.enable ''
          # Send the SSH key of the initrd
          gpg --decrypt '${config.security.gnupg.store}/initrd/ssh.key.gpg' |
          ssh ${target} install -D -m 400 -o root -g root /dev/stdin /root/initrd/ssh.key
          # Send the Wireguard key of the initrd
          gpg --decrypt '${config.security.gnupg.store}/wireguard/wg-intra/privateKey.gpg' |
          ssh ${target} install -D -m 400 -o root -g root /dev/stdin /root/initrd/wg-intra.key
          '' + ''
          ssh ${target} \
            nix-env --profile '${profile}' --set '${build.toplevel}' '&&' \
            '${profile}'/bin/switch-to-configuration switch
          ''
        )).outPath;
      };
      # Example: nix run .#carotte.install-sd
      "install-sd" = {
        type = "app";
        program = (pkgs.writeShellScript "install-sd" ''
          export PATH="$PATH:${with pkgs; lib.makeBinPath [coreutils zstd]}"
          set -eux
          set -o pipefail
          nix-store --add-root hosts/${hostName}.root --indirect --realise ${build.sdImage}
          unzstd --stdout ${build.sdImage}/sd-image/*.img.zst |
          sudo -k dd conv=notrunc oflag=direct,sync status=progress of="''${1:-/dev/mmcblk0}"
        '').outPath;
      };
      # Example: nix run .#losurdo.sendkeys
      "sendkeys" = {
        type = "app";
        #program = config.security.gnupg.agent.sendKeys + "/bin/gnupg-agent-sendKeys";
        program = (pkgs.writeShellScript "sendkeys" ''
          set -eux
          ${pkgs.bash}/bin/bash -eux ${config.security.gnupg.agent.sendKeys + "/bin/gnupg-agent-sendKeys"}
        '').outPath;
      };
    }) inputs.self.nixosConfigurations;}
  );
}