{
  inputs = {
    nixpkgs.url = "github:nixos/nixpkgs/nixos-25.05";
    unstable.url = "github:nixos/nixpkgs/nixos-unstable";

    disko.url = "github:nix-community/disko/latest";
    disko.inputs.nixpkgs.follows = "nixpkgs";

    impermanence.url = "github:nix-community/impermanence";

    agenix.url = "github:ryantm/agenix";
    agenix.inputs.nixpkgs.follows = "nixpkgs";
    agenix.inputs.darwin.follows = "";
  };
  outputs =
    inputs@{
      self,
      nixpkgs,
      unstable,
      disko,
      impermanence,
      agenix,
      ...
    }:
    let
      pkgsFor = system: import nixpkgs {
        inherit system;
        config.allowUnfree = true;
        overlays = [
          agenix.overlays.default
        ];
      };
      forAllSystems =
        f:
        nixpkgs.lib.genAttrs
          [ "x86_64-linux" "aarch64-linux" ]
          (system: f (pkgsFor system));
    in
    {
      nixosConfigurations.oden = nixpkgs.lib.nixosSystem {
        pkgs = pkgsFor "x86_64-linux";
        modules = [
          ./configuration.nix
          disko.nixosModules.disko
          impermanence.nixosModules.impermanence
          agenix.nixosModules.default
        ];
        specialArgs = {
          inherit inputs;
        };
      };
      packages = forAllSystems (pkgs: {
        deploy = pkgs.writeShellScriptBin "deploy" ''
          [ -n "$1" ] && action="$1" || action="switch"
          nixos-rebuild --flake .#oden "$action" --target-host oden --build-host oden --use-remote-sudo
        '';
      });
      devShells = forAllSystems (pkgs: {
        default = pkgs.mkShellNoCC {
          packages = [
            pkgs.agenix
            self.packages.${pkgs.system}.deploy
          ];
        };
      });
    };
}