{
  lib,
  pkgs,
  sources,
  ...
}:
let
  inherit (import ./constants.nix) pathToRoot pathFromRoot;
  inherit (pkgs) system;
  deployment-config = {
    inherit pathToRoot pathFromRoot;
    nodeName = "mypve";
    targetSystem = system;
    sshOpts = [ ];
  };
  deployment =
    (import ../common/data-model.nix {
      inherit system;
      config = deployment-config;
      proxmox-username = "root@pam";
      proxmox-password = "mytestpw";
      node-name = "";
      # opt not to pass `inputs`, as we could only pass serializable arguments through to its self-call
    })."tf-proxmox-deployment".tf-proxmox-host;
  # tracking non-tarball downloads seems unsupported still in npins:
  # https://github.com/andir/npins/issues/163
  minimalIso = pkgs.fetchurl {
    url = "https://releases.nixos.org/nixos/24.05/nixos-24.05.7139.bcba2fbf6963/nixos-minimal-24.05.7139.bcba2fbf6963-x86_64-linux.iso";
    hash = "sha256-plre/mIHdIgU4xWU+9xErP+L4i460ZbcKq8iy2n4HT8=";
  };
  machine =
    (import "${pkgs.nixos-generators}/share/nixos-generator/nixos-generate.nix" {
      inherit system;
      inherit (sources) nixpkgs;
      formatConfig = "${pkgs.nixos-generators}/share/nixos-generator/formats/proxmox.nix";
      configuration = deployment.nixos-configuration;
    }).config;
in
{
  _class = "nixosTest";
  imports = [
    ../common/data-model-options.nix
  ];

  name = "deployment-model";
  sourceFileset = lib.fileset.unions [
    ../../run/tf-proxmox/run.sh
  ];

  nodes.mypve =
    { sources, ... }:
    {
      imports = [
        "${sources.proxmox-nixos}/modules/proxmox-ve"
      ];
      users.users.root = {
        password = "mytestpw";
        hashedPasswordFile = lib.mkForce null;
      };
      services.proxmox-ve = {
        enable = true;
        ipAddress = "192.168.1.1";
        vms = {
          myvm1 = {
            vmid = 100;
            memory = 1024;
            cores = 1;
            sockets = 1;
            kvm = true;
            scsi = [ { file = "local:16"; } ];
            cdrom = "local:iso/minimal.iso";
          };
        };
      };
      virtualisation = {
        additionalPaths = [ minimalIso ];
        diskSize = 4096;
        memorySize = 2048;
      };
    };

  nodes.deployer =
    { ... }:
    {
      nix.nixPath = [
        (lib.concatStringsSep ":" (lib.mapAttrsToList (k: v: k + "=" + v) sources))
      ];

      environment.systemPackages = [
        deployment.run
      ];

      # needed only when building from deployer
      system.extraDependenciesFromModule =
        { pkgs, ... }:
        {
          environment.systemPackages = with pkgs; [
            hello
          ];
        };
      system.extraDependencies =
        # (lib.lists.map lib.traceVal)
        (
          (lib.lists.concatMap (
            pkg:
            (
              if
                pkg ? inputDerivation
                # error: output '/nix/store/dki9d3vldafg9ydrfm7x0g0rr0qljk98-sudo-1.9.16p2' is not allowed to refer to the following paths:
                #          /nix/store/2xdmps65ryklmbf025bm4pxv16gb8ajv-sudo-1.9.16p2.tar.gz
                #          /nix/store/58br4vk3q5akf4g8lx0pqzfhn47k3j8d-bash-5.2p37
                #          /nix/store/8v6k283dpbc0qkdq81nb6mrxrgcb10i1-gcc-wrapper-14-20241116
                #          /nix/store/9r1nl9ksiyszy4qzzg6y2gcdkca0xmhy-stdenv-linux
                #          /nix/store/a4rmp6in7igbl1wbz9pli5nq0wiclq0y-groff-1.23.0
                #          /nix/store/dki9d3vldafg9ydrfm7x0g0rr0qljk98-sudo-1.9.16p2
                #          /nix/store/f5y58qz2fzpzgkhp0nizixi10x04ppyy-linux-pam-1.6.1
                #          /nix/store/shkw4qm9qcw5sc5n1k5jznc83ny02r39-default-builder.sh
                #          /nix/store/vj1c3wf9c11a0qs6p3ymfvrnsdgsdcbq-source-stdenv.sh
                #          /nix/store/yh6qg1nsi5h2xblcr67030pz58fsaxx3-coreutils-9.6
                && !(lib.strings.hasInfix "sudo" (lib.traceVal (builtins.toString pkg)))
              then
                lib.trace "yes" [
                  # lib.traceVal pkg.inputDerivation # not of type `path in the Nix store'
                  (
                    (
                      x: builtins.trace "${builtins.toString pkg}: ${builtins.toString (lib.isPath x.inputDerivation)}" x
                    )
                    pkg
                  ).inputDerivation
                ]
              else
                lib.trace "no" [ ]
            )
          ) machine.environment.systemPackages)
          ++ [
            (
              (
                x:
                builtins.trace "machine.system.build.toplevel.inputDerivation: ${builtins.toString (lib.isPath x)}" x
              )
              machine.system.build.toplevel.inputDerivation
            )
            (
              (
                x: builtins.trace "machine.system.build.etc.inputDerivation: ${builtins.toString (lib.isPath x)}" x
              )
              machine.system.build.etc.inputDerivation
            )
            (
              (
                x:
                builtins.trace "machine.system.build.etcBasedir.inputDerivation: ${builtins.toString (lib.isPath x)}" x
              )
              machine.system.build.etcBasedir.inputDerivation
            )
            (
              (
                x:
                builtins.trace "machine.system.build.etcMetadataImage.inputDerivation: ${builtins.toString (lib.isPath x)}" x
              )
              machine.system.build.etcMetadataImage.inputDerivation
            )
            (
              (
                x:
                builtins.trace "machine.system.build.extraUtils.inputDerivation: ${builtins.toString (lib.isPath x)}" x
              )
              machine.system.build.extraUtils.inputDerivation
            )
            ((x: builtins.trace "machine.system.path.inputDerivation: ${builtins.toString (lib.isPath x)}" x)
              machine.system.path.inputDerivation
            )
            (
              (
                x:
                builtins.trace "machine.system.build.setEnvironment.inputDerivation: ${builtins.toString (lib.isPath x)}" x
              )
              machine.system.build.setEnvironment.inputDerivation
            )
            (
              (x: builtins.trace "machine.system.build.vm.inputDerivation: ${builtins.toString (lib.isPath x)}" x)
              machine.system.build.vm.inputDerivation
            )
            (
              (
                x:
                builtins.trace "machine.system.build.bootStage1.inputDerivation: ${builtins.toString (lib.isPath x)}" x
              )
              machine.system.build.bootStage1.inputDerivation
            )
            (
              (
                x:
                builtins.trace "machine.system.build.bootStage2.inputDerivation: ${builtins.toString (lib.isPath x)}" x
              )
              machine.system.build.bootStage2.inputDerivation
            )
            pkgs.gnu-config
            # pkgs.gnu-config.inputDerivation
            pkgs.byacc
            # pkgs.byacc.inputDerivation
            pkgs.stdenv
            pkgs.stdenvNoCC
            sources.nixpkgs
            pkgs.vte

            (
              ## We build a whole NixOS system that contains the module
              ## `system.extraDependenciesFromModule`, only to grab its
              ## configuration and the store paths needed to build it and
              ## dump them in `system.extraDependencies`.
              # see: https://git.fediversity.eu/Fediversity/Fediversity/pulls/338/files

              pkgs.closureInfo {
                rootPaths = map (drv: drv.drvPath) (
                  [
                    machine.system.build.toplevel.inputDerivation
                    machine.system.build.etc.inputDerivation
                    machine.system.build.etcBasedir.inputDerivation
                    machine.system.build.etcMetadataImage.inputDerivation
                    machine.system.build.extraUtils.inputDerivation
                    machine.system.path.inputDerivation
                    machine.system.build.setEnvironment.inputDerivation
                    machine.system.build.vm.inputDerivation
                    machine.system.build.bootStage1.inputDerivation
                    machine.system.build.bootStage2.inputDerivation
                  ]
                  ++ lib.concatMap (x: if x ? source.inputDerivation then [ x.source.inputDerivation ] else [ ]) (
                    lib.attrValues machine.environment.etc
                  )
                  ++ machine.environment.systemPackages
                );
              }
            )

          ]
          ++ lib.concatLists (
            lib.mapAttrsToList (
              _k: v:
              if v ? source.inputDerivation then
                [
                  # v.source.inputDerivation
                  (
                    (
                      x:
                      builtins.trace "${builtins.toString (lib.attrNames v)}: ${builtins.toString (lib.isPath x.source.inputDerivation)}" x
                    )
                    v
                  ).source.inputDerivation
                ]
              else
                [ ]
            ) machine.environment.etc
          )
        );
    };

  extraTestScript = ''
    mypve.wait_for_unit("pveproxy.service")
    assert "running" in mypve.succeed("pveproxy status")
    mypve.succeed("mkdir -p /run/pve")
    assert "Proxmox" in mypve.succeed("curl -s -i -k https://localhost:8006")

    # mypve.succeed("pvesh set /access/password --userid root@pam --password mypwdlol --confirmation-password mytestpw 1>&2")
    # mypve.succeed("curl -s -i -k -d '{\"userid\":\"root@pam\",\"password\":\"mypwdhaha\",\"confirmation-password\":\"mypwdlol\"}' -X PUT https://localhost:8006/api2/json/access/password 1>&2")
    # on mistake: 401 No ticket
    # mypve.succeed("haha")

    with subtest("Run the deployment"):
      # target.fail("hello 1>&2")
      deployer.succeed("""
        ${lib.getExe deployment.run}
      """)
      # target.wait_for_unit("multi-user.target")
      # target.succeed("su - operator -c hello 1>&2")
  '';
}