{ self, pkgs, machines, dns, myLib, flake-utils, kubenix, nixhelm, blog-pim, ... }: flake-utils.lib.eachDefaultSystem
  (system:
  let
    mkKubenixPackage = module: kubenix.packages.${system}.default.override
      {
        specialArgs = { inherit myLib kubenix nixhelm system dns blog-pim machines; };
        module = { imports = [ module ]; };
      };

    deployScript = (pkgs.writeScriptBin "kubenix" (builtins.readFile ./kubenix-deploy.sh)).overrideAttrs (old: {
      buildCommand = "${old.buildCommand}\npatchShebangs $out";
    });

    mkDeployScript = kubernetes: applyset: namespace:
      let
        kubeconfig = kubernetes.kubeconfig or "";
        result = kubernetes.result or "";

        wrappedDeployScript = pkgs.symlinkJoin
          {
            name = "kubenix";
            paths = [ deployScript pkgs.vals pkgs.kubectl ];
            buildInputs = [ pkgs.makeWrapper ];
            passthru.manifest = result;

            postBuild = ''
              wrapProgram $out/bin/kubenix \
                --suffix PATH : "$out/bin" \
                --run 'export KUBECONFIG=''${KUBECONFIG:-${toString kubeconfig}}' \
                --set MANIFEST '${result}' \
                --set APPLYSET 'applyset-${applyset}' \
                --set NAMESPACE '${namespace}'
            '';
          };
      in
      wrappedDeployScript;

    mkDeployScriptAndManifest = module: applyset: namespace:
      let
        kubernetes = (kubenix.evalModules.${system} {
          specialArgs = { inherit namespace myLib blog-pim; };

          module = { kubenix, ... }:
            {
              imports = [
                kubenix.modules.k8s
                "${self}/kubenix-modules/custom"
                module
              ];

              config = {
                kubenix.project = applyset;
                kubernetes.namespace = namespace;
              };
            };
        }).config.kubernetes;
      in
      {
        manifest = kubernetes.result;
        deploy = mkDeployScript kubernetes applyset namespace;
      };
  in
  {
    kubenix.all.deploy = mkKubenixPackage "${self}/kubenix-modules/all.nix";
    kubenix.bootstrap.deploy = mkKubenixPackage "${self}/kubenix-modules/base.nix";

    kubenix.cyberchef = mkDeployScriptAndManifest
      "${self}/kubenix-modules/cyberchef.nix" "cyberchef" "static-websites";
    kubenix.freshrss = mkDeployScriptAndManifest
      "${self}/kubenix-modules/freshrss.nix" "freshrss" "freshrss";
    kubenix.radicale = mkDeployScriptAndManifest
      "${self}/kubenix-modules/radicale.nix" "radicale" "radicale";
    kubenix.kms = mkDeployScriptAndManifest
      "${self}/kubenix-modules/kms.nix" "kms" "kms";
    kubenix.atuin = mkDeployScriptAndManifest
      "${self}/kubenix-modules/atuin.nix" "atuin" "atuin";
    kubenix.blog = mkDeployScriptAndManifest
      "${self}/kubenix-modules/blog.nix" "blog" "static-websites";
    kubenix.nextcloud = mkDeployScriptAndManifest
      "${self}/kubenix-modules/nextcloud.nix" "nextcloud" "nextcloud";
    kubenix.hedgedoc = mkDeployScriptAndManifest
      "${self}/kubenix-modules/hedgedoc.nix" "hedgedoc" "hedgedoc";
    kubenix.kitchenowl = mkDeployScriptAndManifest
      "${self}/kubenix-modules/kitchenowl.nix" "kitchenowl" "kitchenowl";
    kubenix.forgejo = mkDeployScriptAndManifest
      "${self}/kubenix-modules/forgejo" "forgejo" "forgejo";
  })