{
  description = "FredOS NixOS configuration";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
    home-manager = {
      url = "github:nix-community/home-manager/release-26.05";
      inputs.nixpkgs.follows = "nixpkgs";
    };

    zen-browser = {
      url = "github:0xc000022070/zen-browser-flake";
      # no nixpkgs.follows: zen needs ffmpeg_9, only in unstable
      inputs.home-manager.follows = "home-manager";
    };

    nix-cachyos-kernel.url = "github:xddxdd/nix-cachyos-kernel/release";

    proton-cachyos-nix.url = "github:powerofthe69/proton-cachyos-nix";

    loupe = {
      url = "git+https://forg.gregersen.it/lazzexus/Loupe";
      inputs.nixpkgs.follows = "nixpkgs";
    };

    # Source only, not this flake's outputs: nixpkgs' redlib predates the wreq
    # switch and Reddit 403s its rustls TLS fingerprint (see services/redlib.nix).
    redlib = {
      url = "github:redlib-org/redlib";
      flake = false;
    };

    stylix.url = "github:nix-community/stylix/release-26.05";
  };
  outputs =
    { self
    , nixpkgs
    , home-manager
    , zen-browser
    , nix-cachyos-kernel
    , stylix
    , proton-cachyos-nix
    , ...
    } @ inputs:
    let
      system = "x86_64-linux";
      baseModules = hostname: [
        ./hosts/${hostname}.nix
        ./common.nix
        home-manager.nixosModules.home-manager
        stylix.nixosModules.stylix
        ./settings/stylix.nix
      ];
      mkHost = hostname: extraModules: nixpkgs.lib.nixosSystem {
        inherit system;
        specialArgs = { inherit inputs; };
        modules = baseModules hostname ++ extraModules;
      };
    in
    {
      # Everything FredOS-Gaming is, minus the hardware — for anyone who wants
      # to run this config on their own machine. They import this module next
      # to their own hardware-configuration.nix from their own flake (readme.md
      # has the snippet). `_module.args` stands in for mkHost's specialArgs,
      # which a plain module can't set.
      nixosModules.gaming = { lib, ... }: {
        imports = baseModules "FredOS-Gaming";
        _module.args.inputs = inputs;

        # Hostname gates every FredOS-Gaming module, so it has to keep matching.
        # These four otherwise live in hosts/hardware/FredOS-Gaming.nix, which
        # is exactly the file a guest replaces.
        networking.hostName = "FredOS-Gaming";
        nixpkgs.hostPlatform = lib.mkDefault system;
        system.stateVersion = lib.mkDefault "25.11";
        boot.loader.systemd-boot.enable = lib.mkDefault true;
        boot.loader.efi.canTouchEfiVariables = lib.mkDefault true;

        # nordhammer.it is my build server and those are my SSH keys; neither
        # belongs on someone else's machine.
        nix.distributedBuilds = lib.mkForce false;
        users.users.fred.openssh.authorizedKeys.keys = lib.mkForce [ ];
      };

      nixosConfigurations = {
        FredOS-Gaming      = mkHost "FredOS-Gaming"      [ ./hosts/hardware/FredOS-Gaming.nix ];
        FredOS-Mediaserver = mkHost "FredOS-Mediaserver" [ ./hosts/hardware/FredOS-Mediaserver.nix ];
        FredOS-Macbook     = mkHost "FredOS-Macbook"     [ ./hosts/hardware/FredOS-Macbook.nix ];
        FredOS-Kayla       = mkHost "FredOS-Kayla"       [ ./hosts/hardware/FredOS-Kayla.nix ];

        # Mediaserver's services on fake hardware, for testing from-scratch
        # bring-up (arr-interconnect especially) in a throwaway VM:
        #   nixos-rebuild build-vm --flake .#mediaserver-vm
        mediaserver-vm     = mkHost "FredOS-Mediaserver" [ ./hosts/hardware/vm.nix ];

        # Kayla's desktop in a window, for trying the Plasma session out before
        # her machine exists.
        #   nixos-rebuild build-vm --flake .#kayla-vm
        kayla-vm           = mkHost "FredOS-Kayla"       [ ./hosts/hardware/kayla-vm.nix ];
      };
    };
}