{

  description = "my krops file";

  inputs = {
    secrets = {
      url = "git+ssh://gitea@git.ingolf-wagner.de/palo/nixos-secrets.git?ref=main";
      flake = false;
    };
    nixpkgs.url = "github:nixos/nixpkgs/nixos-22.11";
    nixos-hardware = {
      url = "github:nixos/nixos-hardware";
      inputs.nixpkgs.follows = "nixpkgs";
    };

    # colmena
    # -------
    colmena = {
      url = "github:zhaofengli/colmena";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    nixpkgs-unstable.url = "github:nixos/nixpkgs/nixos-unstable";
    nixpkgs-legacy.url = "github:nixos/nixpkgs/nixos-22.05";
    polygon-art = {
      url = "git+https://git.ingolf-wagner.de/palo/polygon-art.git";
    };
    sops-nix.url = "github:Mic92/sops-nix";
    emacs-overlay = {
      url = "github:nix-community/emacs-overlay";
      flake = false;
    };
    doom-emacs-nix = {
      url = "github:nix-community/nix-doom-emacs";
      inputs.nixpkgs.follows = "nixpkgs";
      #inputs.emacs-overlay.follows = "emacs-overlay";
    };
    home-manager = {
      url = "github:nix-community/home-manager/release-22.11";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    home-manager-utils = {
      url = "github:mrvandalo/home-manager-utils";
      inputs.home-manager.follows = "home-manager";
    };
    nixpkgs-fmt = {
      url = "github:nix-community/nixpkgs-fmt";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    grocy-scanner = {
      url = "github:mrVanDalo/grocy-scanner";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    permown = {
      url = "github:mrVanDalo/module.permown";
      #url = "git+file:///home/palo/dev/nixos/permown";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    private_assets = {
      #url = "git+file:///home/palo/dev/nixos/nixos-private-assets";
      url = "git+ssh://gitea@git.ingolf-wagner.de/palo/nixos-private-assets.git?ref=main";
      flake = true;
    };
    retiolum = {
      url = "github:Mic92/retiolum";
      #url = "git+file:///home/palo/dev/nixos/retiolum";
    };
    landingpage = {
      #url = "git+file:///home/palo/dev/landingpage";
      url = "github:mrVanDalo/landingpage";
    };
    kmonad = {
      url = "github:kmonad/kmonad?dir=nix";
      inputs.nixpkgs.follows = "nixpkgs";
    };
  };

  outputs =
    { self
    , colmena
    , doom-emacs-nix
    , emacs-overlay
    , grocy-scanner
    , home-manager
    , home-manager-utils
    , nixos-hardware
    , nixpkgs
    , nixpkgs-fmt
    , nixpkgs-legacy
    , nixpkgs-unstable
    , permown
    , polygon-art
    , private_assets
    , secrets
    , sops-nix
    , retiolum
    , landingpage
    , kmonad
    }:
    let
      system = "x86_64-linux";
      pkgs = nixpkgs.legacyPackages.${system};

      pullNetworkPasswords = pkgs.writers.writeBashBin "pull-network-passwords" ''
        # collect all network configurations and save them in the store
        sudo ls /etc/NetworkManager/system-connections \
            | while read file
            do
            sudo cat "/etc/NetworkManager/system-connections/$file" \
                | ${pkgs.pass}/bin/pass insert -m "krops/desktop_secrets/network-manager/system-connections/$file"
            done
      '';
      pushNetworkPasswords = pkgs.writers.writeBashBin "push-network-passwords" ''
        echo "push network passwords to $1"
      '';
    in
    {
      # colmena
      devShell.${system} =
        pkgs.mkShell {
          buildInputs = [
            colmena.packages.${system}.colmena
            pushNetworkPasswords
            pullNetworkPasswords
            nixpkgs-fmt.defaultPackage.${system}
          ];
        };

      colmena =
        let
          sopsModule = name: { lib, ... }: {
            sops.defaultSopsFile = lib.mkForce "${secrets}/secrets/${name}.yaml";
            imports = [
              sops-nix.nixosModules.sops
            ];
          };
        in
        {

          meta = {
            nixpkgs = import nixpkgs {
              system = "x86_64-linux";
              overlays = [
                (_self: _super: {
                  # we assign the overlay created before to the overlays of nixpkgs.
                  unstable = nixpkgs-unstable.legacyPackages.${pkgs.system};
                  legacy = nixpkgs-legacy.legacyPackages.${pkgs.system};
                  polygon-art = polygon-art.packages.${pkgs.system};
                  landingpage = landingpage.packages.${pkgs.system}.plain;
                })
              ];
            };
            specialArgs = {
              inherit private_assets;
              assets = ./nixos/assets;
            };
          };

          defaults = { name, pkgs, lib, ... }: {
            deployment.buildOnTarget = lib.mkDefault true;
            nix = {
              # no channesl needed this way
              nixPath = [ "nixpkgs=${pkgs.path}" ];
              # make flakes available
              package = pkgs.nixUnstable;
              extraOptions = ''
                experimental-features = nix-command flakes
              '';
              settings = {
                substituters = [ "https://colmena.cachix.org" ];
                trusted-public-keys = [ "colmena.cachix.org-1:7BzpDnjjH8ki2CT3f6GdOk7QAzPOl+1t3LvTLXqYcSg=" ];
              };
            };
            environment.systemPackages = [
              nixpkgs-fmt.defaultPackage.${system}
              colmena.packages.${system}.colmena
            ];
            boot.tmpOnTmpfs = lib.mkDefault true; # make /tmp a tmpfs (performance!)
            imports = [
              ./nixos/machines/${name}/configuration.nix
              (sopsModule name)
              home-manager.nixosModules.home-manager
              permown.nixosModules.permown
            ];
            home-manager.useGlobalPkgs = true;
            home-manager.useUserPackages = true;
          };

          cream = { name, nodes, pkgs, ... }: {
            deployment.allowLocalDeployment = true;
            deployment.targetHost = "${name}.private";
            deployment.tags = [ "desktop" "online" "private" ];
            imports = [
              grocy-scanner.nixosModule
              nixos-hardware.nixosModules.framework-12th-gen-intel
              #retiolum.nixosModules.retiolum
              #kmonad.nixosModules.default
              private_assets.nixosModules.jobrad
            ];
            # todo : check out => https://github.com/terlar/nix-config/blob/ad35fbfc20e58626eb9fbd5f67716bc07bb98fc9/home-manager/modules/profiles/user/terje/keyboards.nix
            #services.kmonad = {
            #  enable = false;
            #  keyboards.laptop-keyboard = {
            #    name = "laptop-keyboard";
            #    device = "";
            #  };
            #};

            home-manager.users.mainUser = {
              imports = [
                doom-emacs-nix.hmModule
                home-manager-utils.hmModule
              ];
            };
          };

          sterni = { name, nodes, pkgs, ... }: {
            deployment.allowLocalDeployment = true;
            deployment.targetHost = "${name}.private";
            deployment.tags = [ "desktop" "online" "private" ];
            imports = [
              grocy-scanner.nixosModule
              nixos-hardware.nixosModules.lenovo-thinkpad-x220
              retiolum.nixosModules.retiolum
            ];

            home-manager.users.mainUser = {
              imports = [
                doom-emacs-nix.hmModule
                home-manager-utils.hmModule
              ];
            };
          };

          sternchen = { name, nodes, pkgs, ... }: {
            deployment.targetHost = "${name}.secret";
            deployment.tags = [ "desktop" ];
            imports = [
              grocy-scanner.nixosModule
            ];
            home-manager.users.mainUser = {
              imports = [
                doom-emacs-nix.hmModule
                home-manager-utils.hmModule
              ];
              programs.doom-emacs.enable = false;
            };
          };

          pepe = { name, nodes, pkgs, ... }: {
            deployment.targetHost = "${name}.private";
            deployment.tags = [ "server" "online" "private" ];
            imports = [
              grocy-scanner.nixosModule
              nixos-hardware.nixosModules.lenovo-thinkpad-x220
            ];
          };

          robi = { name, nodes, pkgs, ... }: {
            deployment.targetHost = "${name}.private";
            deployment.tags = [ "server" "online" "private" ];
            imports = [
              nixos-hardware.nixosModules.common-cpu-intel
              nixos-hardware.nixosModules.common-gpu-intel
            ];
            home-manager.users.root = {
              home.stateVersion = "22.11";
              imports = [
                doom-emacs-nix.hmModule
              ];
              programs.doom-emacs = {
                enable = true;
                emacsPackage = pkgs.emacs-nox;
                doomPrivateDir = ./doom.d;
              };
            };
          };

          bobi = { name, nodes, pkgs, ... }: {
            deployment.targetHost = "${name}.private";
            deployment.buildOnTarget = false;
            deployment.tags = [ "desktop" "usb" "private" ];
            imports = [
              grocy-scanner.nixosModule
            ];
            home-manager.users.mainUser = {
              imports = [
                doom-emacs-nix.hmModule
                home-manager-utils.hmModule
              ];
            };
          };

          mobi = { name, nodes, pkgs, ... }: {
            deployment.targetHost = "${name}.private";
            deployment.buildOnTarget = false;
            deployment.tags = [ "desktop" "usb" "private" ];
            imports = [
              grocy-scanner.nixosModule
            ];
            home-manager.users.mainUser = {
              imports = [
                doom-emacs-nix.hmModule
                home-manager-utils.hmModule
              ];
            };
          };
        };
    };
}