{
  description = "Forgejo CI Runners";

  inputs = {
    nixpkgs.url = "github:nixos/nixpkgs/nixos-24.05";
    srvos.url = "github:numtide/srvos";
    disko.url = "github:nix-community/disko";
    cachix-deploy-flake.url = "github:cachix/cachix-deploy-flake";
    flake-utils.url = "github:numtide/flake-utils";
    # sops-nix - secrets with mozilla sops
    # https://github.com/Mic92/sops-nix
    sops-nix = {
      url = "github:Mic92/sops-nix";
      inputs.nixpkgs.follows = "nixpkgs";
    };
  };

  outputs = { self, sops-nix, nixpkgs, srvos, disko, cachix-deploy-flake, flake-utils, ... }@inputs:
    flake-utils.lib.eachDefaultSystem (
      system: {
        defaultPackage = let
          pkgs = import nixpkgs { inherit system; };
          cachix-deploy-lib = cachix-deploy-flake.lib pkgs;
        in
        cachix-deploy-lib.spec
        {
          agents = {
            "fj-hetzner-aarch64-01" = cachix-deploy-lib.nixos {
            # system = "aarch64-linux";
            imports = [
              sops-nix.nixosModules.sops
              srvos.nixosModules.hardware-hetzner-cloud
              srvos.nixosModules.server
              srvos.nixosModules.mixins-systemd-boot
              disko.nixosModules.disko
              ./agents/fj-hetzner-aarch64.nix
              (import ./disko-hetzner-cloud.nix { disks = [ "/dev/sda" ]; })
              {
                boot.loader.efi.canTouchEfiVariables = true;
                networking.hostName = "fj-hetzner-aarch64-01";
                users.users.root.openssh.authorizedKeys.keys = 
                [ 
                  "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBsUe5YF5z8vGcEYtQX7AAiw2rJygGf2l7xxr8nZZa7w jahanson@legiondary"
                  "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJyA/yMPPo+scxBaDFUk7WeEyMAMhXUro5vi4feOKsJT jahanson@durincore"
                ];
                services.openssh.enable = true;
                services.openssh.settings.PermitRootLogin = "without-password";
              }];
            };
            "fj-shadowfax-01" = cachix-deploy-lib.nixos {
            # system = "x86_64-linux";
            imports = [
              sops-nix.nixosModules.sops
              ./hardware/shadowfax-kubevirt.nix
              srvos.nixosModules.server
              srvos.nixosModules.mixins-systemd-boot
              disko.nixosModules.disko
              ./agents/fj-shadowfax-x86_64.nix
              (import ./disko-shadowfax-kubevirt.nix { disks = [ "/dev/sda" ]; })
              {
                boot.loader.efi.canTouchEfiVariables = true;
                networking.hostName = "fj-shadowfax-01";
                users.users.root.openssh.authorizedKeys.keys = 
                [ 
                  "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBsUe5YF5z8vGcEYtQX7AAiw2rJygGf2l7xxr8nZZa7w jahanson@legiondary"
                  "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJyA/yMPPo+scxBaDFUk7WeEyMAMhXUro5vi4feOKsJT jahanson@durincore"
                ];
                services.openssh.enable = true;
                services.openssh.settings.PermitRootLogin = "without-password";
              }];
            };
            "fj-shadowfax-02" = cachix-deploy-lib.nixos {
            # system = "x86_64-linux";
            imports = [
              sops-nix.nixosModules.sops
              ./hardware/shadowfax-kubevirt.nix
              srvos.nixosModules.server
              srvos.nixosModules.mixins-systemd-boot
              disko.nixosModules.disko
              ./agents/fj-shadowfax-x86_64.nix
              (import ./disko-shadowfax-kubevirt.nix { disks = [ "/dev/sda" ]; })
              {
                boot.loader.efi.canTouchEfiVariables = true;
                networking.hostName = "fj-shadowfax-02";
                users.users.root.openssh.authorizedKeys.keys = 
                [ 
                  "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBsUe5YF5z8vGcEYtQX7AAiw2rJygGf2l7xxr8nZZa7w jahanson@legiondary"
                  "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJyA/yMPPo+scxBaDFUk7WeEyMAMhXUro5vi4feOKsJT jahanson@durincore"
                ];
                services.openssh.enable = true;
                services.openssh.settings.PermitRootLogin = "without-password";
              }];
            };
          };
        };
      });
      # Convenience output that aggregates the outputs for home, nixos.
      # Also used in ci to build targets generally.
      # top =
      #   let
      #     nixtop = nixpkgs.lib.genAttrs
      #       (builtins.attrNames inputs.self.nixosConfigurations)
      #       (attr: inputs.self.nixosConfigurations.${attr}.config.system.build.toplevel);
      #   in
      #   nixtop;
}