{
  inputs,
  config,
  lib,
  ...
}:
let
  mkHost =
    name: machine:
    hostArgs@{ pkgs, ... }:
    let
      account = config.facts.account;
      services = lib.mapAttrs (_: service: removeAttrs service [ "origin" ]) config.facts.services;
    in
    {
      imports = [
        config.flake.modules.nixos.${name}
      ];

      facts = {
        inherit (config.facts)
          account
          externalDevices
          machines
          topology
          ;
        inherit services;
        machine = machine // {
          inherit name;
        };
      };

      networking.hostName = name;
      system.stateVersion = machine.stateVersion;

      programs.zsh.enable = true;

      sops.secrets.hashed-password.neededForUsers = true;

      users.users.${account.name} = {
        isNormalUser = true;
        home = account.homeDirectory;
        hashedPasswordFile = hostArgs.config.sops.secrets.hashed-password.path;
        extraGroups = [
          "wheel"
          "networkmanager"
        ];
        shell = pkgs.zsh;
      };

      home-manager.users.${account.name}.home = {
        username = account.name;
        homeDirectory = account.homeDirectory;
        stateVersion = machine.hmStateVersion;
      };
    };
in
{
  imports = [
    inputs.flake-parts.flakeModules.modules
    ./facts.nix
  ];

  systems = [ "x86_64-linux" ];

  flake.nixosConfigurations =
    assert lib.assertMsg (builtins.hasAttr config.facts.topology.server.machine config.facts.machines)
      "facts.topology.server.machine must name an entry in facts.machines";
    builtins.mapAttrs (
      name: machine:
      inputs.nixpkgs.lib.nixosSystem {
        inherit (machine) system;
        specialArgs = { inherit inputs; };
        modules = [ (mkHost name machine) ];
      }
    ) config.facts.machines;

  perSystem =
    { pkgs, ... }:
    {
      formatter = pkgs.nixfmt-tree;
    };
}