{
  inputs,
  sources,
  system,
}:

let
  overlay = _: prev: {
    terraform-backend = prev.callPackage ../../modules/terraform-backend/package.nix { };
    # FIXME centralize overlays
    # XXX using recent revision for https://github.com/NixOS/nixpkgs/pull/447849
    opentofu =
      (pkgs.callPackage "${sources.nixpkgs-unstable}/pkgs/by-name/op/opentofu/package.nix" { })
      .overrideAttrs
        (old: rec {
          patches = (old.patches or [ ]) ++ [
            # TF with back-end poses a problem for nix: initialization involves both
            # mutation (nix: only inside build) and a network call (nix: not inside build)
            ../../check/data-model-tf/02-opentofu-sandboxed-init.patch
          ];
          # versions > 1.9.0 need go 1.24+
          version = "1.9.0";
          src = pkgs.fetchFromGitHub {
            owner = "opentofu";
            repo = "opentofu";
            tag = "v${version}";
            hash = "sha256-e0ZzbQdex0DD7Bj9WpcVI5roh0cMbJuNr5nsSVaOSu4=";
          };
          vendorHash = "sha256-fMTbLSeW+pw6GK8/JLZzG2ER90ss2g1FSDX5+f292do=";
        });
  };
  pkgs = import sources.nixpkgs {
    inherit system;
    overlays = [ overlay ];
  };
in
pkgs.testers.runNixOSTest {
  imports = [
    ../../data-model.nix
    ../../function.nix
    ../common/nixosTest.nix
    ./nixosTest.nix
  ];
  _module.args = { inherit inputs sources; };
  inherit (import ./constants.nix)
    targetMachines
    pathToRoot
    pathFromRoot
    enableAcme
    ;
}