{
  description = "NixOS Infrastructure";

  inputs = {
    nixos.follows = "nixpkgs-unstable";
    nixpkgs.follows = "nixpkgs-unstable";
    nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
    nixos-hardware.url = "github:NixOS/nixos-hardware";
  };

  outputs = { self, nixpkgs, nixos-hardware, ... }:
  let
    # Global domain
    domain = "domain.com";
    git_url = "git+https://git.${domain}/owner/infra.git";

    # Per-user mapping of auth (login) and sudo keys
    key_mappings = {
      alice = {
        auth = [
          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAliceAuthKeyPlaceholder alice@host"
        ];
        sudo = [
          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAliceSudoKeyPlaceholder alice-admin@host"
        ];
      };
      bob = {
        auth = [
          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBobAuthKeyPlaceholder bob@host"
        ];
        sudo = [
          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBobSudoKeyPlaceholder bob-admin@host"
        ];
      };
    };

    sharedModules = [
      ./modules/users.nix
      ./modules/auto-update.nix
      ./modules/nginx.nix
    ];

    # Central subdomain -> service mapping.
    # Each entry can set:
    #   description   human-readable label (used as the gatus monitor name)
    #   ports.http    local port nginx proxies to
    #   websockets    enable WebSocket proxying
    #   gatus_health  health-check path monitored by gatus (e.g. "/health").
    #                 Leave empty/unset to hide this host from the status page.
    vhosts = {
      "auth.${domain}" = {
        description = "Keycloak";
        ports = {"http" = 8080; };
        gatus_health = "/health";
      };
      "status.${domain}" = {
        description = "Gatus status page";
        ports = {"http" = 8081; };
        gatus_health = "/";
      };
      "pad.${domain}" = {
        # TODO: not implemented (hidden from gatus until gatus_health is set)
        description = "HedgeDoc";
        ports = {"http" = 3001; "httpws" = 3001; };
        websockets = true;
      };
      "git.${domain}" = {
        description = "Gitea";
        ports = { "http" = 3000; "ssh" = 22; };
        gatus_health = "/";
      };
    };

    baseArgs = {
      inherit domain git_url key_mappings vhosts;
    };
  in {
    nixosConfigurations = {
      auth.domain.com = nixpkgs.lib.nixosSystem {
        system = "x86_64-linux";
        specialArgs = baseArgs // {
          domains = [ "auth.${domain}" "status.${domain}" ];
        };
        modules = [
          ./machines/auth.domain.com/configuration.nix
          ./machines/auth.domain.com/hardware-configuration.nix
          ./modules/keycloak.nix
          ./modules/gatus_service.nix
        ] ++ sharedModules;
      };

      status.domain.com = nixpkgs.lib.nixosSystem {
        system = "x86_64-linux";
        specialArgs = baseArgs // {
          domains = [ "pad.${domain}" "git.${domain}" ];
        };
        modules = [
          ./machines/status.domain.com/configuration.nix
          ./machines/status.domain.com/hardware-configuration.nix
          ./modules/gitea.nix
        ] ++ sharedModules;
      };
    };
  };
}