{
  inputs,
  config,
  ...
}:
let
  nixosModules = config.flake.modules.nixos;
  homeModules = config.flake.modules.homeManager;
  metaLib = config.meta.lib;
in
{
  flake.modules.nixos.orion-admin =
    { pkgs, ... }:
    {
      users.users.kiri = {
        linger = true;
        openssh.authorizedKeys.keys = [
          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAU2LydkXRTtNFY7oyX8JQURwXLVhB71DeK8XzrXeFX1 openpgp:0xA490D93A"
        ];
      };

      environment.systemPackages = [
        pkgs.kitty
      ];
    };

  flake.modules.nixos.orion = metaLib.mkHost {
    name = "orion";
    users = {
      inherit (metaLib.users) kiri;
    };

    imports = [
      nixosModules.host-base
      nixosModules.sops-host-ssh-key
      nixosModules.openssh
      nixosModules.caddy
      nixosModules.server-firewall
      nixosModules.ssh-agent-auth
      nixosModules.orion-admin
      nixosModules.vaultwarden
      nixosModules.radicale
      nixosModules.actual
      nixosModules.gitea
      (metaLib.mkHostUser {
        account = metaLib.users.kiri;
        needsPassword = false;
        homeImports = [ homeModules.kiri-server ];
      })
      ./_hardware.nix
      ./_disk.nix
    ];
  };
}