{
  description = "Gebos — IoT telemetry stack on bare-metal NixOS";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
    flake-parts.url = "github:hercules-ci/flake-parts";
    deploy-rs.url = "github:serokell/deploy-rs";
    process-compose-flake.url = "github:Platonic-Systems/process-compose-flake";
    services-flake.url = "github:juspay/services-flake";
    sops-nix = {
      url = "github:Mic92/sops-nix";
      inputs.nixpkgs.follows = "nixpkgs";
    };
  };

  outputs = inputs@{ self, flake-parts, nixpkgs, deploy-rs, ... }:
    flake-parts.lib.mkFlake { inherit inputs; } {
      systems = [ "x86_64-linux" "aarch64-linux" ];

      imports = [
        inputs.process-compose-flake.flakeModule
      ];

      flake = {
        nixosModules = import ./nix/modules;
        nixosConfigurations = import ./nix/hosts { inherit inputs; };
        deploy = import ./nix/deploy.nix { inherit inputs; };

        # `nix flake check` runs deploy-rs's schema check on every node
        checks = builtins.mapAttrs
          (system: deployLib: deployLib.deployChecks self.deploy)
          deploy-rs.lib;
      };

      perSystem = { config, pkgs, system, ... }: {
        packages = {
          ingester = pkgs.callPackage ./ingester { };
          frontend = pkgs.callPackage ./frontend { };
        };

        devShells.default = pkgs.mkShell {
          packages = with pkgs; [
            go
            gopls
            nodejs_24
            postgresql_17
            supabase-cli
            deploy-rs.packages.${system}.default
            sops
            age
            ssh-to-age
          ];
        };

        # `nix run .#dev` — full stack locally via process-compose-flake.
        # Real service wiring lives in nix/dev/process-compose.nix.
        process-compose.dev = import ./nix/dev/process-compose.nix {
          inherit pkgs;
          inherit (inputs) services-flake;
        };
      };
    };
}