{
  description = "NixOS Infrastructure";

  inputs = {
    nixos.follows = "nixpkgs-unstable";
    nixpkgs.follows = "nixpkgs-unstable";
    nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
    nixos-hardware.url = "github:NixOS/nixos-hardware";
  };

  outputs = { self, nixpkgs, nixos-hardware, ... }:
  let
    # Authorization keys for user mappings (login keys per user)
    auth_keys = {
      alice = [
        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIALiceKeyPlaceholder alice@host"
      ];
      bob = [
        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBobKeyPlaceholder bob@host"
      ];
    };

    # Sudo keys per user (keys granting sudo, applied to root)
    sudo_keys = [
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAISudoKeyPlaceholder admin@host"
    ];

    sharedModules = [
      ./modules/users.nix
    ];

    sharedArgs = {
      inherit auth_keys sudo_keys;
    };
  in {
    nixosConfigurations = {
      auth.domain.com = nixpkgs.lib.nixosSystem {
        system = "x86_64-linux";
        specialArgs = sharedArgs;
        modules = [
          ./machines/auth.domain.com/configuration.nix
          ./machines/auth.domain.com/hardware-configuration.nix
          ./modules/keycloak.nix
        ] ++ sharedModules;
      };

      status.domain.com = nixpkgs.lib.nixosSystem {
        system = "x86_64-linux";
        specialArgs = sharedArgs;
        modules = [
          ./machines/status.domain.com/configuration.nix
          ./machines/status.domain.com/hardware-configuration.nix
        ] ++ sharedModules;
      };
    };
  };
}