{
  description = "nix infra for tangled";

  inputs = {
    nixpkgs.url = "github:nixos/nixpkgs/nixos-25.11";
    tangled.url = "git+https://knot1.tangled.sh/tangled.org/core";
    tangled-svfe.url = "git+https://tangled.org/tangled.org/core?ref=sv-fe";
    tangled-lexicons = {
      url = "git+https://tangled.org/tangled.org/core?ref=sv-fe";
      flake = false;
    };
    hydrant = {
      url = "git+https://tangled.org/ptr.pet/hydrant";
      flake = false;
    };
    hydrant-fork = {
      url = "git+https://tangled.org/boltless.me/hydrant?ref=patch";
      flake = false;
    };
    microcosm-rs = {
      url = "git+https://knot1.tangled.sh/boltless.me/microcosm-rs?ref=nix-vendor-fjall";
      flake = false;
    };
    tangled-ozone.url = "git+https://tangled.org/oppi.li/ozone?ref=customized";
    tranquil-mock-pds.url = "git+https://tangled.org/boltless.me/tranquil-pds?ref=liar";
    tranquil-org-pds.url = "git+https://tangled.org/oppi.li/tranquil-pds?ref=op/vynuyrksymxl";
    colmena.url = "github:zhaofengli/colmena/release-0.4.x";
    cloudflare-ips-v4 = {
      url = "file+https://www.cloudflare.com/ips-v4";
      flake = false;
    };
    cloudflare-ips-v6 = {
      url = "file+https://www.cloudflare.com/ips-v6";
      flake = false;
    };
    # Aggregated prefix lists for the clouds hosting the scraper fleet.
    # AS45102 = Alibaba (hosting, announces both 8.208/12 and 47.80/13);
    # AS132203 = Tencent. Deliberately *not* AS37963 (Alibaba China): it
    # announces 9.4M addresses and none of the observed traffic.
    # Refresh with `nix flake update asn-alibaba asn-tencent`.
    asn-alibaba = {
      url = "file+https://raw.githubusercontent.com/ipverse/asn-ip/9ded4fded5a63e5c49c43dfbe56461633e879254/as/45102/aggregated.json";
      flake = false;
    };
    asn-tencent = {
      url = "file+https://raw.githubusercontent.com/ipverse/asn-ip/9ded4fded5a63e5c49c43dfbe56461633e879254/as/132203/aggregated.json";
      flake = false;
    };
    disko = {
      url = "github:nix-community/disko";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    nixery-flake = {
      type = "github";
      owner = "tazjin";
      repo = "nixery";
      flake = false;
    };
    atlogin.url = "git+https://tangled.org/anirudh.fi/atlogin?rev=6fb1a6799585acbc26399ed821fca44abf12466d";
  };

  outputs = {
    nixpkgs,
    disko,
    colmena,
    cloudflare-ips-v4,
    cloudflare-ips-v6,
    asn-alibaba,
    asn-tencent,
    nixery-flake,
    tangled,
    tangled-svfe,
    tangled-lexicons,
    hydrant,
    hydrant-fork,
    microcosm-rs,
    atlogin,
    tangled-ozone,
    tranquil-mock-pds,
    tranquil-org-pds,
    ...
  }: let
    lib = nixpkgs.lib;
    system = "x86_64-linux";
    supportedSystems = ["x86_64-linux" "x86_64-darwin" "aarch64-linux" "aarch64-darwin"];
    forAllSystems = lib.genAttrs supportedSystems;
    nixpkgsFor = forAllSystems (system: nixpkgs.legacyPackages.${system});
    commonArgs = import ./common/ssh.nix;
    cloudflareRanges = lib.filter (line: line != "") (lib.concatMap
      (input: lib.splitString "\n" (builtins.readFile input.outPath))
      [cloudflare-ips-v4 cloudflare-ips-v6]);
    scraperAsnRanges =
      lib.concatMap
      (input: (builtins.fromJSON (builtins.readFile input.outPath)).prefixes.ipv4)
      [asn-alibaba asn-tencent];

    baseModules = [
      disko.nixosModules.disko
      ./common/base.nix
      ./common/nginx.nix
      ./common/tailscale.nix
    ];

    mkHost = hostname: extraModules:
      lib.nixosSystem {
        inherit system;
        specialArgs =
          {
            inherit commonArgs cloudflareRanges scraperAsnRanges;
            hydrant-src = hydrant;
            microcosm-src = microcosm-rs;
            tangled-lexicons-src = tangled-lexicons;
            nixery-pkgs = import nixery-flake.outPath {
              pkgs = import nixpkgs {inherit system;};
            };
            tangled-pkgs = tangled.packages.x86_64-linux;
            tangled-svfe-pkgs = tangled-svfe.packages.x86_64-linux;
          }
          // (hosts.${hostname}.specialArgs or {});
        modules = baseModules ++ [./hosts/${hostname}/configuration.nix] ++ extraModules;
      };

    mkColmenaHost = hostname: targetHost: targetPort: extraModules: {
      deployment = {
        inherit targetHost targetPort;
        targetUser = "tangler";
        buildOnTarget = true;
      };
      nixpkgs.system = system;
      time.timeZone = "Europe/Helsinki";
      imports = baseModules ++ [./hosts/${hostname}/configuration.nix] ++ extraModules;
    };

    hosts = {
      appview = {
        modules = [
          tangled.nixosModules.appview
          ./hosts/appview/services/appview.nix
          ./hosts/appview/services/nginx.nix
          ./hosts/appview/services/litestream.nix
        ];
        target = "95.111.205.38";
        port = 2222;
      };

      hyd-eu-1 = {
        modules = [./modules/hyd-node];
        target = "46.224.9.195";
      };

      mock-eu-1 = {
        modules = [
          ./modules/hyd-node/hydrant.nix
          tranquil-mock-pds.nixosModules.tranquil-pds
          ./hosts/mock-eu-1/services/mock-pds.nix
          ./hosts/mock-eu-1/services/nginx.nix
        ];
        specialArgs.hydrant-src = hydrant-fork;
        target = "35.228.210.244";
      };

      pds = {
        modules = [
          ./hosts/pds/services/nginx.nix
          ./hosts/pds/services/pds.nix
          ./hosts/pds/services/pocket.nix
        ];
        target = "tngl.sh";
      };

      nixery = {
        modules = [
          tangled.nixosModules.spindle
          ./hosts/nixery/services/nginx.nix
          ./hosts/nixery/services/openbao/openbao.nix
          ./hosts/nixery/services/openbao/proxy.nix
          ./hosts/nixery/services/nixery.nix
        ];
        target = "nixery.tangled.sh";
      };

      spindle = {
        modules = [
          tangled.nixosModules.spindle
          ./hosts/spindle/services/openbao/openbao.nix
          ./hosts/spindle/services/openbao/proxy.nix
          ./hosts/spindle/services/spindle.nix
          ./hosts/spindle/services/nginx.nix
        ];
        target = "spindle.alpha.tangled.sh";
      };

      spindle-hel = {
        modules = [
          tangled-svfe.nixosModules.spindle
          ./hosts/spindle-hel/services/openbao/openbao.nix
          ./hosts/spindle-hel/services/openbao/proxy.nix
          ./hosts/spindle-hel/services/spindle.nix
          ./hosts/spindle-hel/services/cache.nix
          ./hosts/spindle-hel/services/nginx.nix
        ];
        target = "135.181.240.228";
        port = 2222;
      };

      prometheus-hel = {
        modules = [
          ./hosts/prometheus-hel/services/prometheus.nix
        ];
        target = "62.238.19.177";
      };

      sandbox-hel = {
        modules = [
          tangled-svfe.nixosModules.deliberi
          ./hosts/sandbox-hel/services/deliberi.nix
          ./hosts/sandbox-hel/services/nginx.nix
        ];
        target = "95.216.140.191";
      };

      ozone-hel = {
        modules = [
          tangled-ozone.nixosModules.ozone
          ./hosts/ozone-hel/services/ozone.nix
          ./hosts/ozone-hel/services/nginx.nix
        ];
        target = "62.238.114.62";
      };

      tranquil-nbg = {
        modules = [
          tranquil-org-pds.nixosModules.default
          ./hosts/tranquil-nbg/services/tranquil-pds.nix
          ./hosts/tranquil-nbg/services/nginx.nix
        ];
        target = "2.28.48.178";
      };

      knot1 = {
        modules = [
          tangled-svfe.nixosModules.knot-rs
          ./hosts/knot1/services/knot2.nix
          ./hosts/knot1/services/nginx.nix
          ./hosts/knot1/services/ssh.nix
        ];
        target = "85.9.211.103";
        port = 2222;
      };

      mirror-fsn = {
        modules = [
          tangled-svfe.nixosModules.knotmirror
          tangled-svfe.nixosModules.zoekt-tnglserver
          atlogin.nixosModules.default
          ./hosts/mirror-fsn/services/knotmirror.nix
          ./hosts/mirror-fsn/services/nginx.nix
          ./hosts/mirror-fsn/services/atlogin.nix
          ./hosts/mirror-fsn/services/zoekt.nix
        ];
        target = "136.243.149.102";
      };
    };
  in {
    nixosConfigurations =
      lib.mapAttrs
      (name: host: mkHost name host.modules)
      hosts;

    colmenaHive = colmena.lib.makeHive (
      {
        meta = {
          nixpkgs = nixpkgs.legacyPackages.${system};
          specialArgs = {
            inherit commonArgs cloudflareRanges scraperAsnRanges;
            hydrant-src = hydrant;
            microcosm-src = microcosm-rs;
            tangled-lexicons-src = tangled-lexicons;
            nixery-pkgs = import nixery-flake.outPath {
              pkgs = import nixpkgs {inherit system;};
            };
            tangled-pkgs = tangled.packages.x86_64-linux;
            tangled-svfe-pkgs = tangled-svfe.packages.x86_64-linux;
          };
          nodeSpecialArgs = lib.mapAttrs (_: host: host.specialArgs or {}) hosts;
        };
      }
      // lib.mapAttrs
      (name: host: mkColmenaHost name host.target (host.port or 22) host.modules)
      hosts
    );
    apps = lib.genAttrs ["x86_64-darwin" "aarch64-darwin"] (system: let
      pkgs = import nixpkgs {
        inherit system;
        config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) ["terraform"];
      };
      # deploy-gcp.nu shells out to all of these
      deploy-gcp = pkgs.writeShellScriptBin "deploy-gcp" ''
        export PATH="${lib.makeBinPath [
          pkgs.nushell
          pkgs.google-cloud-sdk
          pkgs.terraform
          pkgs.git
          pkgs.jujutsu
          pkgs.openssh
          pkgs.curl
        ]}:$PATH"
        exec ${pkgs.nushell}/bin/nu ${./deploy-gcp.nu} "$@"
      '';
    in {
      deploy-gcp = {
        type = "app";
        program = "${deploy-gcp}/bin/deploy-gcp";
      };
    });

    formatter = forAllSystems (system: nixpkgsFor.${system}.alejandra);

  };
}