{ pkgs, writeCommand, lib, secrets, nixosRebuildCommand ? "switch" }:
let

  # command that ensures we use flake.nix during switch
  command = targetPath:
    let
      commandLine = "TMPDIR=/tmp nixos-rebuild ${nixosRebuildCommand} --flake ${targetPath} -L --keep-going";
    in
    ''
      echo '${commandLine}'
      nix-shell \
       -E "with import <nixpkgs> {}; mkShell { buildInputs = [ git (nixos { nix.package = nixFlakes; }).nixos-rebuild ]; }" \
       --run '${commandLine}'
    '';

  source = {
    secrets.file = {
      path = "${secrets}/secrets";
      useChecksum = true;
    };
    private_assets.pass = {
      dir = toString ~/.password-store;
      name = "krops/private_assets";
    };
    assets.file = {
      path = toString ./assets;
      useChecksum = true;
    };
    configs.file = {
      path = toString ./configs;
      useChecksum = true;
    };
    library.file = {
      path = toString ./library;
      useChecksum = true;
    };
    modules.file = {
      path = toString ./modules;
      useChecksum = true;
    };
    pkgs.file = {
      path = toString ./pkgs;
      useChecksum = true;
    };
    system.file = {
      path = toString ./system;
      useChecksum = true;
    };
    "flake.nix".file = {
      path = toString ./flake.nix;
      useChecksum = true;
    };
    "flake.lock".file = {
      path = toString ./flake.lock;
      useChecksum = true;
    };
  };

  server = { name, host }:
    let
      system = writeCommand "/bin/system" {
        source = lib.evalSource [ source ];
        force = true;
        target = lib.mkTarget "root@${host}/var/krops";
        inherit command;
      };
    in
    {
      "${name}" = pkgs.writers.writeBashBin name ''
        echo "deploy system"
        ${system}/bin/system
      '';
    };

  desktop = { name, host }:
    let
      system = writeCommand "/bin/system" {
        source = lib.evalSource [ source ];
        force = true;
        target = lib.mkTarget "root@${host}/var/krops";
        inherit command;
      };
      network = writeCommand "/bin/secrets" {
        source = lib.evalSource [{
          system-connections.pass = {
            dir = toString ~/.password-store;
            name = "krops/desktop_secrets/network-manager/system-connections";
          };
        }];
        force = true;
        target = lib.mkTarget "root@${host}/etc/NetworkManager";
      };
    in
    {
      "${name}" = pkgs.writers.writeBashBin "${name}-all" ''
        echo "deploy network secerts"
        ${network}/bin/secrets
        echo "deploy system"
        ${system}/bin/system
      '';
    };

in
(desktop {
  name = "sterni";
  host = "sterni.private";
}) //
(desktop {
  name = "sternchen";
  host = "sternchen.secret";
}) //
(server {
  name = "pepe";
  host = "pepe.private";
}) //
(server {
  name = "workhorse";
  host = "workhorse.private";
}) //
(server {
  name = "sputnik";
  host = "sputnik.private";
})