{ inputs, ... }:
{
  flake.modules.homeManager.workbench =
    {
      config,
      lib,
      pkgs,
      ...
    }:
    let
      home = config.home.homeDirectory;
      root = "${home}/yookr/workbench";
      companySecrets = "${home}/.config/nixos/modules/secrets/company.yaml";
      environmentInputs = builtins.toJSON {
        inputs = {
          nixpkgs.url = "path:${inputs.nixpkgs}";
          git-hooks.url = "path:${inputs.devenv.inputs.git-hooks}";
        };
      };
      secretsManifest = (pkgs.formats.toml { }).generate "workbench-secrets.toml" {
        project = {
          name = "workbench";
          revision = "1";
        };
        providers.company = "sops://${companySecrets}?age_key_file=/var/lib/sops/keys.txt";
        profiles =
          lib.mapAttrs
            (
              _: names:
              lib.genAttrs names (name: {
                description = name;
                ref.item = name;
                providers = [ "company" ];
              })
            )
            {
              company = [
                "email"
                "password"
              ];
              live = [
                "YOOKR_MYSQL_LIVE_DATABASE_URL"
                "YOOKR_MONGODB_LIVE_DATABASE_URL"
              ];
            };
      };
      mountObs = pkgs.writeShellApplication {
        name = "mount-company-obs";
        runtimeInputs = [
          pkgs.python3
          pkgs.rclone
          pkgs.sops
        ];
        text = ''
          export PATH=/run/wrappers/bin:"$PATH"
          exec python3 ${./mount-obs.py} ${lib.escapeShellArg companySecrets} ${lib.escapeShellArg "${root}/obs"}
        '';
      };
      mountSharepoint = pkgs.writeShellApplication {
        name = "mount-company-sharepoint";
        runtimeInputs = [
          pkgs.rclone
          pkgs.coreutils
        ];
        text = ''
          export PATH=/run/wrappers/bin:"$PATH"
          mkdir -p ${lib.escapeShellArg "${root}/sharepoint"}
          export RCLONE_CONFIG_SHAREPOINT_TYPE=combine
          export RCLONE_CONFIG_SHAREPOINT_UPSTREAMS='Algemeen=company-sharepoint: Projecten=company-sharepoint-projecten:'
          exec rclone mount sharepoint: ${lib.escapeShellArg "${root}/sharepoint"} \
            --config ${lib.escapeShellArg "${config.xdg.configHome}/rclone/rclone.conf"} \
            --read-only --vfs-cache-mode off --buffer-size 8M
        '';
      };
      mountService = name: command: {
        Unit = {
          Description = "Read-only company ${name} mount";
          After = [ "network-online.target" ];
          StartLimitIntervalSec = 0;
        };
        Service = {
          Type = "simple";
          ExecStart = lib.getExe command;
          ExecStop = "/run/wrappers/bin/fusermount3 -u ${root}/${name}";
          Environment = "SOPS_AGE_KEY_FILE=/var/lib/sops/keys.txt";
          UMask = "0077";
          Restart = "on-failure";
          RestartSec = 60;
        };
        Install.WantedBy = [ "default.target" ];
      };
    in
    {
      # devenv already installs its bundled SecretSpec CLI in the workstation profile.
      home.packages = lib.remove pkgs.secretspec (import ./_support/tools.nix { inherit pkgs; }).packages;
      programs.zsh.initContent = lib.mkAfter ''
        workbench-reload() {
          if [[ "''${DEVENV_ROOT:-}" != ${lib.escapeShellArg root} ]]; then
            print -u2 'Enter the workbench devenv shell before loading credentials.'
            return 1
          fi
          local exports
          exports="$(${pkgs.python3}/bin/python3 ${./load-secrets.py} ${secretsManifest} "$@")" || return
          eval "$exports"
        }
      '';

      home.file."yookr/workbench/devenv.yaml".text = environmentInputs;
      home.file."yookr/workbench/devenv.nix".text = ''
        { pkgs, ... }:
        let tools = import ${./_support/tools.nix} {
          inherit pkgs;
          garden = import ${../yookr-dev/_support/packages.nix} { inherit pkgs; };
        };
        in {
          inherit (tools) packages env;
          enterShell = ${lib.strings.escapeNixString ''
            if [ "''${WORKBENCH_TOOLS_ONLY:-0}" = 1 ]; then
              eval "$(python3 ${./load-secrets.py} ${secretsManifest} --tools-only)"
            else
              eval "$(python3 ${./load-secrets.py} ${secretsManifest})"
            fi
          ''};
        }
      '';
      systemd.user.services = {
        company-obs = mountService "obs" mountObs;
        company-sharepoint = mountService "sharepoint" mountSharepoint;
      };
    };
}