{
  lib,
  pkgs,
  sources ? import ../npins,
  ...
}:
pkgs.stdenv.mkDerivation {
  name = "tf-repo";
  src = ../.;
  buildInputs = [
    (import ./tf.nix { inherit lib pkgs; })
  ];
  buildPhase = ''
    runHook preBuild
    pushd launch/

    # pass terraform-nixos path to TF through variable
    # when switching TF to nix take this directly from `inputs`
    # https://codeberg.org/kiara/e2ed-hetzner/commit/84b2a349d3e48ea2a17340bceff762d834fd4046

    echo "{\"terraform-nixos\": \"${sources.terraform-nixos}\"}" > module.auto.tfvars.json
    # point to the relevant providers
    tofu init -input=false

    popd
    runHook postBuild
  '';
  # FIXME: can the above even work without a connection?
  installPhase = ''
    runHook preInstall

    cp -r . $out

    runHook postInstall
  '';
}