{
  pkgs,
  lib,
  config,
  system,
  ...
}:
let
  nivSources = import ./nix/sources.nix;
  asGithubRef = src: "github:${src.owner}/${src.repo}/${src.rev}";

  build_target =
    let
      env_host = builtins.getEnv "NIXOS_TARGET_HOST";
    in
    if env_host != "" then
      env_host
    else
      builtins.replaceStrings [ "\n" ] [ "" ] (lib.toLower (builtins.readFile /proc/sys/kernel/hostname));

  host_modules = {
    grimmauld-nixos = [ ./specific/grimm-nixos-laptop/configuration.nix ];
    grimm-nixos-ssd = [ ./specific/grimm-nixos-ssd/configuration.nix ];

    grimmauld-nixos-server = [
      ./specific/grimmauld-nixos-server/configuration.nix
      ./modules
    ];
  };

  nixpkgs_patches = [
    #{
    #  # xonsh update
    #  url = "https://patch-diff.githubusercontent.com/raw/NixOS/nixpkgs/pull/305316.patch";
    #  hash = "sha256-W3jh6qRA/7V1fImLm3vRmaT6h6gL5rlNBUuIidZHaZc=";
    #}
  ];

in
# enable ccache for lix if ccache is enabled
# enable_lix_ccache = true;
{
  imports = [
    "${nivSources.agenix}/modules/age.nix"
    "${nivSources.nixos-mailserver}/default.nix"
    "${nivSources.nixos-matrix-modules}/module.nix"

    (builtins.getFlake (asGithubRef nivSources.aagl-gtk-on-nix)).nixosModules.default

    # fixme: ideally we'd not rely on the flake syntax to load the module
    (builtins.getFlake (asGithubRef nivSources.chaotic)).nixosModules.default
    # (builtins.getFlake (asGithubRef nivSources.nixos-matrix-modules)).nixosModules.default
    # (builtins.getFlake "git+${nivSources.nixos-mailserver.repo}").nixosModules.default
  ] ++ lib.optionals (builtins.hasAttr build_target host_modules) host_modules.${build_target};

  system.nixos = {
    distroId = "lixos";
    distroName = "LixOS";
  };

  environment.sessionVariables =
    let
      inherit (config.system.nixos) distroName version codeName;
    in
    {
      distro = "${distroName} ${version} (${codeName}) ${system}";
    };

  documentation.doc.enable = false;

  # nix.settings.extra-sandbox-paths = [ config.programs.ccache.cacheDir ];
  # programs.ccache.enable = true;

  environment.systemPackages =
    let
      inherit (lib)
        getExe
        attrNames
        optionalString
        elem
        concatLines
        ;
      inherit (pkgs) writeShellScriptBin nix-output-monitor;
    in
    [
      (writeShellScriptBin "nixos-build-all" (
        concatLines (
          map (
            n:
            "NIXOS_TARGET_HOST=${n} nixos-rebuild build --show-trace --upgrade"
            + optionalString (elem nix-output-monitor config.environment.systemPackages) " |& ${getExe nix-output-monitor}"
          ) (attrNames host_modules)
        )
      ))
    ];

  nixpkgs =
    let
      src = nivSources.nixpkgs;
      unpatched = import src { inherit config system; };
      inherit (unpatched) applyPatches fetchpatch;

      config = {
        allowUnfree = true;
        permittedInsecurePackages = [
          "olm-3.2.16"
          "jitsi-meet-1.0.8043"
        ];
      };
    in
    {
      hostPlatform = system;
      pkgs =
        if (nixpkgs_patches != [ ]) then
          (import (applyPatches {
            name = "nixpkgs-patched";
            inherit src;
            patches = map fetchpatch nixpkgs_patches;
          }) { inherit config; })
        else
          unpatched;

      overlays = [
        # (import "${nivSources.lix-module}/overlay.nix" { lix = nivSources.lix-pkg; })
        (final: prev: { agenix = final.callPackage "${nivSources.agenix}/pkgs/agenix.nix" { }; })
      ];
    };

  _module.args = {
    system = "x86_64-linux";
    inputs = nivSources;
  };

  nix.package = pkgs.lix;

  nix.settings.extra-substituters = [
    #    "https://cache.lix.systems"
    "https://nyx.chaotic.cx/"
    "https://ezkea.cachix.org"
  ];

  nix.settings.trusted-public-keys = [
    #    "cache.lix.systems:aBnZUw8zA7H35Cz2RyKFVs3H4PlGTLawyY5KRbvJR8o="
    "nyx.chaotic.cx-1:HfnXSw4pj95iI/n17rIDy40agHj12WfF+Gqk6SonIT8="
    "chaotic-nyx.cachix.org-1:HfnXSw4pj95iI/n17rIDy40agHj12WfF+Gqk6SonIT8="
    "ezkea.cachix.org-1:ioBmUbJTZIKsHmWWXPe1FSFbeVe+afhfgqgTSNd34eI="
  ];
}