{
  inputs = {
    nixops4.follows = "nixops4-nixos/nixops4";
    nixops4-nixos.url = "github:nixops4/nixops4-nixos";
  };

  outputs =
    inputs:
    {
      nixConfig = {
        extra-trusted-substituters = "https://cache.saumon.network/proxmox-nixos";
        extra-trusted-public-keys = "proxmox-nixos:D9RYSWpQQC/msZUWphOY2I5RLH5Dd6yQcaHIuug7dWM=";
      };
    }
    // import ./mkFlake.nix inputs (
      { inputs, sources, ... }:
      {
        imports = [
          "${sources.git-hooks}/flake-module.nix"
          inputs.nixops4.modules.flake.default

          ./deployment/flake-part.nix
          ./infra/flake-part.nix
          ./keys/flake-part.nix
          ./secrets/flake-part.nix
          ./services/tests/flake-part.nix
        ];

        perSystem =
          {
            pkgs,
            lib,
            system,
            ...
          }:
          {
            checks = {
              panel = (import ./. { inherit sources system; }).tests.panel.basic;
            };
            formatter = pkgs.nixfmt-rfc-style;

            pre-commit.settings.hooks =
              let
                ## Add a directory here if pre-commit hooks shouldn't apply to it.
                optout = [ "npins" ];
                excludes = map (dir: "^${dir}/") optout;
                addExcludes = lib.mapAttrs (_: c: c // { inherit excludes; });
              in
              addExcludes {
                nixfmt-rfc-style.enable = true;
                deadnix.enable = true;
                trim-trailing-whitespace.enable = true;
                shellcheck.enable = true;
              };

            # https://192.168.51.81:8006/#v1:0:=node%2Fnode051:4:::::8::=apitokens

            # apps.default = {
            #   type = "app";
            #   program = pkgs.writers.writeBashBin "provision-proxmox.sh"
            #     {
            #       makeWrapperArgs = [
            #         "--prefix"
            #         "PATH"
            #         ":"
            #         "${lib.makeBinPath [
            #           pkgs.jq
            #           pkgs.httpie
            #         ]}"
            #       ];
            #     }
            #     ''
            #       sh ./infra/proxmox-remove.sh    --api-url "https://192.168.51.81:8006/api2/json" --username "kiara@ProcoliX" --password "" 7014 # test14
            #       sh ./infra/proxmox-provision.sh --api-url "https://192.168.51.81:8006/api2/json" --username "kiara@ProcoliX" --password "" test14
            #     '';
            # };

            # api_token = "terraform@pve!provider=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
            # kiara@ProcoliX!dsdfsfdsfd=30df234b-02f3-4ed9-b778-00d28ad3499c

            apps.default =
              let
                inherit (pkgs) system;
                # FIXME rewire to defer env var
                deployment = pkgs.writeShellScriptBin "my-app-with-environment" ''
                  export PROXMOX_VE_SSH_USERNAME="kiara@ProcoliX"
                  export PROXMOX_VE_SSH_PASSWORD=""
                    ${(import ./deployment/check/common/data-model.nix {
                      inherit system;
                      config = {
                        targetSystem = system;
                        nodeName = "192.168.51.81"; # root@fediversity-proxmox
                        pathToRoot = builtins.path {
                          path = ./.;
                          name = "root";
                        };
                        sshOpts = [ ];
                        key-file = "";
                        node-name = "node051";
                        bridge = "ovsbr0";
                        vlanId = 1305;
                        imageDatastoreId = "local";
                        vmDatastoreId = "linstor_storage";
                        cdDatastoreId = "local-lvm";
                        ipv4Gateway = "eth0";
                        ipv4Address = "";
                        # ipv4Address = "95.215.187.${vm-id}";
                        ipv6Gateway = "eth0";
                        ipv6Address = "";
                        # ipv6Address = "2a00:51c0:13:1305::${vm-id}";
                      };
                      # opt not to pass `inputs`, as we could only pass serializable arguments through to its self-call
                    })."tf-proxmox-deployment".tf-proxmox-host
                    }
                '';
              in
              {
                type = "app";
                program = deployment.run;
              };

          };
      }
    );
}