{
  description = "NixOS definitions for our physical servers";

  inputs = {
    nixpkgs.url = "github:nixos/nixpkgs/nixos-23.11";
    nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
    deploy-rs.url = "github:serokell/deploy-rs";
    nixos-hardware.url = "github:NixOS/nixos-hardware/master";

    disko = {
      url = "github:nix-community/disko";
      inputs.nixpkgs.follows = "nixpkgs";
    };

    agenix = {
      url = "github:ryantm/agenix";
      inputs.nixpkgs.follows = "nixpkgs";
    };

    dns = {
      url = "github:kirelagin/dns.nix";
      inputs.nixpkgs.follows = "nixpkgs";
    };

    microvm = {
      url = "github:astro/microvm.nix";
      inputs.nixpkgs.follows = "nixpkgs";
    };
  };

  outputs =
    { self, nixpkgs, deploy-rs, disko, agenix, nixpkgs-unstable, dns, microvm, nixos-hardware, ... }:
    let
      controllerArch = "x86_64-linux";
      pkgs = nixpkgs.legacyPackages.${controllerArch};
      lib = pkgs.lib;
      pkgs-unstable = nixpkgs-unstable.legacyPackages.${controllerArch};
      machines = (lib.modules.evalModules { modules = [ (import ./nixos/machines) ]; }).config.machines;
      physicalMachines = lib.filterAttrs (n: v: v.type == "physical") machines;
      mkNixosSystems = systemDef:
        builtins.mapAttrs
          (name: machine:
            nixpkgs.lib.nixosSystem (systemDef name machine)
          )
          physicalMachines;
      mkDeployNodes = nodeDef:
        builtins.mapAttrs
          (name: machine: nodeDef name machine)
          physicalMachines;
    in
    {
      devShells.${controllerArch}.default = pkgs.mkShell {
        packages = with pkgs; [
          libsecret
          # TODO: using nixos-anywhere from nixos-unstable produces buffer overflow.
          # Related to this issue: https://github.com/nix-community/nixos-anywhere/issues/242
          # Should wait until this is merged in nixos-unstable.
          # pkgs-unstable.nixos-anywhere
          pkgs-unstable.deploy-rs
          openssl
          postgresql_15
          opentofu
          cdrtools
          kubectl
          ansible
        ];
      };

      formatter.${controllerArch} = pkgs.nixfmt;

      nixosConfigurations = mkNixosSystems (name: machine: {
        system = machine.arch;

        specialArgs = { inherit machines machine dns microvm disko agenix nixos-hardware; };
        modules = [
          ./nixos
          { networking.hostName = name; }
        ];
      });

      deploy = {
        sshUser = "root";
        user = "root";

        nodes = mkDeployNodes (name: machine: {
          hostname = self.nixosConfigurations.${name}.config.networking.fqdn;
          profiles.system = {
            remoteBuild = machine.arch != controllerArch;
            path = deploy-rs.lib."${machine.arch}".activate.nixos
              self.nixosConfigurations.${name};
          };
        });
      };

      # Deploy-rs' flake checks seem broken for architectures different from the deployment machine.
      # We skip these here.
      checks = builtins.mapAttrs
        (system: deployLib:
          deployLib.deployChecks (self.deploy // {
            nodes = (lib.attrsets.filterAttrs
              (name: node:
                machines.${name}.arch == controllerArch
              )
              self.deploy.nodes);
          })
        )
        deploy-rs.lib;
    };
}