{
  description = "Forgejo CI Runners";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
    srvos.url = "github:numtide/srvos";
    disko.url = "github:nix-community/disko";
    # sops-nix - secrets with mozilla sops
    # https://github.com/Mic92/sops-nix
    sops-nix = {
      url = "github:Mic92/sops-nix";
      inputs.nixpkgs.follows = "nixpkgs";
    };
  };

  nixConfig = {
    extra-substituters = [
      "https://nix-community.cachix.org"
      "https://hsndev.cachix.org"
    ];
    extra-trusted-public-keys = [
      "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
      "hsndev.cachix.org-1:vN1/XGBZtMLnTFYDmTLDrullgZHSUYY3Kqt+Yg/C+tE="
    ];
    trusted-users = ["root" "gitea-runner"];
  };

  outputs = { self, sops-nix, nixpkgs, srvos, disko, ... }@inputs:
  let
    linuxMachineName = "linux";
    lib = nixpkgs.lib;
    inherit (self) outputs;
    in {
      nixosConfigurations = 
      {
        "fj-hetzner-aarch64-01" = lib.nixosSystem {
        system = "aarch64-linux";
        specialArgs = {inherit inputs outputs;};
        modules = [
          sops-nix.nixosModules.sops
          srvos.nixosModules.hardware-hetzner-cloud
          srvos.nixosModules.server
          srvos.nixosModules.mixins-systemd-boot
          disko.nixosModules.disko
          ./agents/fj-hetzner-aarch64.nix
          (import ./disko-hetzner-cloud.nix { disks = [ "/dev/sda" ]; })
          {
            boot.loader.efi.canTouchEfiVariables = true;
            networking.hostName = "fj-hetzner-aarch64-01";
            users.users.root.openssh.authorizedKeys.keys = 
            [ 
              "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBsUe5YF5z8vGcEYtQX7AAiw2rJygGf2l7xxr8nZZa7w jahanson@legiondary"
              "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJyA/yMPPo+scxBaDFUk7WeEyMAMhXUro5vi4feOKsJT jahanson@durincore"
            ];
            services.openssh.enable = true;
            services.openssh.settings.PermitRootLogin = "without-password";
          }];
        };
        "fj-shadowfax-01" = lib.nixosSystem {
        system = "x86_64-linux";
        specialArgs = {inherit inputs outputs;};
        modules = [
          sops-nix.nixosModules.sops
          srvos.nixosModules.hardware-hetzner-cloud
          srvos.nixosModules.server
          srvos.nixosModules.mixins-systemd-boot
          disko.nixosModules.disko
          ./agents/fj-shadowfax-x86_64.nix
          (import ./disko-shadowfax-kubevirt.nix { disks = [ "/dev/vda" ]; })
          {
            boot.loader.efi.canTouchEfiVariables = true;
            networking.hostName = "fj-shadowfax-01";
            users.users.root.openssh.authorizedKeys.keys = 
            [ 
              "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBsUe5YF5z8vGcEYtQX7AAiw2rJygGf2l7xxr8nZZa7w jahanson@legiondary"
              "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJyA/yMPPo+scxBaDFUk7WeEyMAMhXUro5vi4feOKsJT jahanson@durincore"
            ];
            services.openssh.enable = true;
            services.openssh.settings.PermitRootLogin = "without-password";
          }];
        };
        "fj-shadowfax-02" = lib.nixosSystem {
        system = "x86_64-linux";
        specialArgs = {inherit inputs outputs;};
        modules = [
          sops-nix.nixosModules.sops
          srvos.nixosModules.hardware-hetzner-cloud
          srvos.nixosModules.server
          srvos.nixosModules.mixins-systemd-boot
          disko.nixosModules.disko
          ./agents/fj-shadowfax-x86_64.nix
          (import ./disko-shadowfax-kubevirt.nix { disks = [ "/dev/vda" ]; })
          {
            boot.loader.efi.canTouchEfiVariables = true;
            networking.hostName = "fj-shadowfax-02";
            users.users.root.openssh.authorizedKeys.keys = 
            [ 
              "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBsUe5YF5z8vGcEYtQX7AAiw2rJygGf2l7xxr8nZZa7w jahanson@legiondary"
              "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJyA/yMPPo+scxBaDFUk7WeEyMAMhXUro5vi4feOKsJT jahanson@durincore"
            ];
            services.openssh.enable = true;
            services.openssh.settings.PermitRootLogin = "without-password";
          }];
        };
      };
  }; 
}