{
  description = "sfos (self-host os)";
  inputs = {
    flake-utils.url = "github:numtide/flake-utils";
    nixpkgs.url = "github:NixOS/nixpkgs/master";
    nixos-facter-modules.url = "github:numtide/nixos-facter-modules";
    systems.url = "github:nix-systems/default";
    colmena = {
      url = "github:zhaofengli/colmena";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    nixos-hardware.url = "github:NixOS/nixos-hardware/master";
    devenv.url = "github:cachix/devenv";
    nix-editor = {
      url = "github:snowfallorg/nix-editor";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    disko = {
      url = "github:nix-community/disko";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    ess = {
      url = "github:acaloiaro/ess/v2.13.0";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    agenix = {
      url = "github:ryantm/agenix";
      inputs.nixpkgs.follows = "nixpkgs";
    };
  };

  outputs = inputs @ {
    agenix,
    colmena,
    devenv,
    disko,
    nixpkgs,
    nix-editor,
    self,
    systems,
    ...
  }: let
    lib = nixpkgs.lib;
    pkgs = nixpkgs.legacyPackages."x86_64-linux";
    forEachSystem = nixpkgs.lib.genAttrs (import systems);
  in {
    inherit lib;
    colmenaHive = colmena.lib.makeHive self.outputs.colmena;
    colmena = {
      meta = {
        nixpkgs = import nixpkgs {
          system = "x86_64-linux";
          overlays = [
            inputs.agenix.overlays.default
          ];
        };
        specialArgs = {
          inherit self;
          inherit inputs;
          inherit (inputs) agenix;
        };
      };
      sfos-0 = ./hosts/sfos-0;
      sfos-1 = ./hosts/sfos-1;
      sfos-2 = ./hosts/sfos-2;
    };
    devShells = forEachSystem (system: let
      config = self.devShells.${system}.default.config;
    in {
      default = devenv.lib.mkShell {
        inherit inputs pkgs;
        modules = [
          {
            languages = {
              nix.enable = true;
            };

            packages = with pkgs; [
              inputs.nix-editor.packages.${system}.default
              inputs.colmena.packages.${system}.colmena
              jq
              opentofu
              pre-commit
            ];

            enterShell =
              #bash
              ''
                run-show-help
              '';

            pre-commit.hooks.env-sample-sync = {
              enable = true;
              always_run = true;
              pass_filenames = false;
              name = "env-sample-sync";
              description = "Sync secrets to env.sample";
              entry = "${inputs.ess.packages.${system}.default}/bin/ess";
            };

            scripts = {
              run-show-help = {
                description = "Show this help text";
                exec = ''
                  echo
                  echo Helper scripts available:
                  echo
                  ${pkgs.gnused}/bin/sed -e 's| |XX|g' \
                    -e 's|=| |' <<EOF | \
                    ${pkgs.util-linuxMinimal}/bin/column -t | \
                    ${pkgs.gnused}/bin/sed -e 's|XX| |g'
                  ${pkgs.lib.generators.toKeyValue {} (pkgs.lib.mapAttrs (name: value: value.description) config.scripts)}
                  EOF
                '';
              };

              sfos-init = {
                description = "Initialize cluster members";
                exec = ''
                  #!/run/current-system/sw/bin/bash
                  cwd=$(pwd)
                  # tofu apply -auto-approve
                  tofu -chdir="$cwd/bootstrap" output -json | jq '.cluster_ips.value | join(",")' | tr -d '"' | tr ',' "\n" | while read  host; do
                      cd "$cwd/hosts"
                      echo "Initializing $host"
                      hostName=$(tofu -chdir="$cwd/bootstrap" output -json | hostName=$host jq -r ".cluster_nodes.value[] | select(.ipv4_address == \"$host\").name")
                      echo "Setting host name: $hostName"
                      ssh_public_key=$(ssh-keyscan $host | grep ssh-ed25519 | cut -d " " -f 2,3)
                      mkdir -p "$hostName/secrets"
                      cp -rf ../common/* "$hostName/"
                      nix-editor "$hostName/default.nix" users.users.sfos.openssh.authorizedKeys.keys -i -v "[\"$TF_VAR_admin_ssh_public_key\"]"
                      nix-editor "$hostName/default.nix" users.users.root.openssh.authorizedKeys.keys -i -v "[\"$TF_VAR_admin_ssh_public_key\"]"
                      nix-editor "$hostName/default.nix" networking.hostName -i -v "\"$hostName\"\;"
                      nix-editor "$hostName/default.nix" deployment.targetHost -i -v "\"$host\"\;"
                      nix-editor "$hostName/secrets/secrets.nix" tailscale_auth_key.publicKeys -i -v "[localMachine \"$ssh_public_key\"]"
                      nix-editor ../flake.nix "outputs.colmena.$hostName" -i -v "./hosts/$hostName";
                      cd "$hostName/secrets"
                      echo "$TF_VAR_tailscale_auth_key" | agenix -e tailscale_auth_key -i ~/.ssh/id_rsa_agenix
                  done
                  cd ../../..
                  git add hosts
                '';
              };
            };
          }
        ];
      };
    });
  };
}