{
  description = "NixOS Infrastructure";

  inputs = {
    nixos.follows = "nixpkgs-unstable";
    nixpkgs.follows = "nixpkgs-unstable";
    nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
    nixos-hardware.url = "github:NixOS/nixos-hardware";
  };

  outputs = { self, nixpkgs, nixos-hardware, ... }:
  let
    # Global domain
    domain = "domain.com";
    git_url = "git+https://git.${domain}/owner/infra.git";

    # Per-user mapping of auth (login) and sudo keys
    key_mappings = {
      alice = {
        auth = [
          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAliceAuthKeyPlaceholder alice@host"
        ];
        sudo = [
          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAliceSudoKeyPlaceholder alice-admin@host"
        ];
      };
      bob = {
        auth = [
          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBobAuthKeyPlaceholder bob@host"
        ];
        sudo = [
          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBobSudoKeyPlaceholder bob-admin@host"
        ];
      };
    };

    sharedModules = [
      ./modules/users.nix
      ./modules/auto-update.nix
    ];

    sharedArgs = {
      inherit domain git_url key_mappings;
    };
  in {
    nixosConfigurations = {
      auth.domain.com = nixpkgs.lib.nixosSystem {
        system = "x86_64-linux";
        specialArgs = sharedArgs;
        modules = [
          ./machines/auth.domain.com/configuration.nix
          ./machines/auth.domain.com/hardware-configuration.nix
          ./modules/keycloak.nix
        ] ++ sharedModules;
      };

      status.domain.com = nixpkgs.lib.nixosSystem {
        system = "x86_64-linux";
        specialArgs = sharedArgs;
        modules = [
          ./machines/status.domain.com/configuration.nix
          ./machines/status.domain.com/hardware-configuration.nix
        ] ++ sharedModules;
      };
    };
  };
}