{
  pkgs,
  lib,
  config,
  system,
  ...
}:
let
  nivSources = import ./nix/sources.nix;
  asGithubRef = src: "github:${src.owner}/${src.repo}/${src.rev}";

  build_target =
    let
      env_host = builtins.getEnv "NIXOS_TARGET_HOST";
    in
    if env_host != "" then
      env_host
    else
      builtins.replaceStrings [ "\n" ] [ "" ] (lib.toLower (builtins.readFile /proc/sys/kernel/hostname));

  host_modules = {
    grimmauld-nixos = [ ./specific/grimm-nixos-laptop/configuration.nix ];

    grimmauld-nixos-server = [
      ./specific/grimmauld-nixos-server/configuration.nix
      ./modules
    ];
  };

  nixpkgs_patches = [
    {
      # xonsh update
      url = "https://patch-diff.githubusercontent.com/raw/NixOS/nixpkgs/pull/305316.patch";
      hash = "sha256-oUjCyA18RvIChTUwPqkO4+v2skTqLBYf2DMd+ADiGE8=";
    }
  ];

  # enable ccache for lix if ccache is enabled
  enable_lix_ccache = true;
in
{
  imports = [
    "${nivSources.agenix}/modules/age.nix"
    "${nivSources.nixos-mailserver}/default.nix"
    "${nivSources.nixos-matrix-modules}/module.nix"
    "${nivSources.authentik-nix}/module.nix"

    # fixme: ideally we'd not rely on the flake syntax to load the module
    (builtins.getFlake (asGithubRef nivSources.chaotic)).nixosModules.default
    # (builtins.getFlake (asGithubRef nivSources.nixos-matrix-modules)).nixosModules.default
    # (builtins.getFlake "git+${nivSources.nixos-mailserver.repo}").nixosModules.default
  ] ++ lib.optionals (builtins.hasAttr build_target host_modules) host_modules.${build_target};

  system.nixos = {
    distroId = "lixos";
    distroName = "LixOS";
  };

  environment.sessionVariables = with config.system.nixos; {
    distro = "${distroName} ${version} (${codeName}) ${system}";
  };

  documentation.doc.enable = false;

  nix.settings.extra-sandbox-paths = [ config.programs.ccache.cacheDir ];
  programs.ccache.enable = true;

  environment.systemPackages =
    with pkgs;
    with lib;
    [
      (writeShellScriptBin "nixos-build-all" (
        concatLines (
          map (
            n:
            "NIXOS_TARGET_HOST=${n} nixos-rebuild build --show-trace --upgrade"
            + optionalString (elem nix-output-monitor config.environment.systemPackages) " |& ${lib.getExe pkgs.nix-output-monitor}"
          ) (attrNames host_modules)
        )
      ))
    ];

  nixpkgs =
    let
      src = nivSources.nixpkgs;
      unpatched = import src { inherit config system; };
      inherit (unpatched) applyPatches fetchpatch;

      config = {
        allowUnfree = true;
      };
    in
    {
      hostPlatform = system;
      pkgs = import (applyPatches {
        name = "nixpkgs-patched";
        inherit src;
        patches = map fetchpatch nixpkgs_patches;
      }) { inherit config; };

      overlays = [
        (import (
          if enable_lix_ccache then
            "${
              applyPatches {
                name = "lix-overlay-ccache";
                src = nivSources.lix-module;
                patches = [ ./patches/lix-ccache.patch ];
              }
            }/overlay.nix"
          else
            "${nivSources.lix-module}/overlay.nix"
        ) { lix = nivSources.lix-pkg; })
        (final: prev: { agenix = final.callPackage "${nivSources.agenix}/pkgs/agenix.nix" { }; })
      ];
    };

  _module.args = {
    system = "x86_64-linux";
  };

  nix.settings.extra-substituters = [
    "https://cache.lix.systems"
    "https://nyx.chaotic.cx/"
    "https://nixcache.grimmauld.de"
  ];

  nix.settings.trusted-public-keys = [
    "cache.lix.systems:aBnZUw8zA7H35Cz2RyKFVs3H4PlGTLawyY5KRbvJR8o="
    "nyx.chaotic.cx-1:HfnXSw4pj95iI/n17rIDy40agHj12WfF+Gqk6SonIT8="
    "chaotic-nyx.cachix.org-1:HfnXSw4pj95iI/n17rIDy40agHj12WfF+Gqk6SonIT8="
    "nixcache.grimmauld.de:LFBlakr8RYIuVb9I1S0+L9JGyB2THcfbPa0W6srghqo="
  ];
}