{
  system ? builtins.currentSystem,
  sources ? import ../npins,
  pkgs ? import sources.nixpkgs { inherit system; },
}:
let
  inherit (sources) agenix;
in
{
  mapping = import ./secrets.nix;
  rootPath = ./.;
  # shell for testing TF directly
  shell = pkgs.mkShellNoCC {
    packages = [
      (pkgs.callPackage "${agenix}/pkgs/agenix.nix" { })
    ];
  };

  # re-export inputs so they can be overridden granularly
  # (they can't be accessed from the outside any other way)
  inherit
    sources
    system
    pkgs
    ;
}