{
  description = "Homelab NixOS configuration";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
    disko = {
      url = "github:nix-community/disko";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    sops-nix = {
      url = "github:Mic92/sops-nix";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    nixos-images = {
      url = "github:nix-community/nixos-images";
      inputs.nixpkgs.follows = "nixpkgs";
    };
  };

  outputs = { self, nixpkgs, disko, sops-nix, nixos-images, ... }@inputs:
    let
      system = "x86_64-linux";
    in
    {
      nixosConfigurations = {
        # Real host — install on the ZimaBlade.
        # disko owns the OS-disk partitioning + filesystems (see disk-config.nix).
        jupiter = nixpkgs.lib.nixosSystem {
          inherit system;
          specialArgs = { inherit inputs; };
          modules = [
            disko.nixosModules.disko
            sops-nix.nixosModules.sops
            ./hosts/jupiter/configuration.nix
          ];
        };

        # netcup VPS — public reverse proxy + tailnet node.
        vps = nixpkgs.lib.nixosSystem {
          inherit system;
          specialArgs = { inherit inputs; };
          modules = [
            disko.nixosModules.disko
            sops-nix.nixosModules.sops
            ./hosts/vps/configuration.nix
          ];
        };

        # VirtualBox test image. Build the OVA with:
        #   nix build .#nixosConfigurations.jupiter-vbox.config.system.build.virtualBoxOVA
        # NOTE: no disko here — the virtualbox-image module supplies the disk.
        jupiter-vbox = nixpkgs.lib.nixosSystem {
          inherit system;
          specialArgs = { inherit inputs; };
          modules = [ ./hosts/jupiter/vm.nix ];
        };

        # Custom kexec installer with our SSH key baked in, for headless install
        # onto a box with a read-only root (ZimaOS) where nixos-anywhere can't
        # ssh-copy-id. Build the tarball:
        #   nix build .#nixosConfigurations.kexec.config.system.build.kexecInstallerTarball
        # then scp it to the target's writable /tmp and run kexec/run (see README).
        kexec = nixpkgs.lib.nixosSystem {
          inherit system;
          modules = [
            nixos-images.nixosModules.kexec-installer
            ({ ... }: {
              users.users.root.openssh.authorizedKeys.keys = [
                "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGZpkPVhzi1zG5JI9hWyUgdyvNIQbp4ts4jw3idpMhhN erik@laptop"
              ];
            })
          ];
        };

        # Bootable USB recovery installer with our SSH key + sshd + DHCP.
        # Build the ISO:
        #   nix build .#nixosConfigurations.installer-iso.config.system.build.isoImage
        # dd it to a USB stick, boot the ZimaBlade from it, SSH in, ./deploy install.
        installer-iso = nixpkgs.lib.nixosSystem {
          inherit system;
          modules = [
            (nixpkgs + "/nixos/modules/installer/cd-dvd/installation-cd-minimal.nix")
            ({ ... }: {
              services.openssh.enable = true;
              services.openssh.settings.PermitRootLogin = "prohibit-password";
              users.users.root.openssh.authorizedKeys.keys = [
                "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGZpkPVhzi1zG5JI9hWyUgdyvNIQbp4ts4jw3idpMhhN erik@laptop"
              ];
              networking.hostName = "jupiter-installer";
            })
          ];
        };
      };
    };
}