{ inputs }:

let
  mkNode = name: hostname: {
    inherit hostname;
    sshUser = "deploy";
    user = "root";
    profiles.system = {
      path = inputs.deploy-rs.lib.x86_64-linux.activate.nixos
        inputs.self.nixosConfigurations.${name};
    };
  };
in
{
  sshOpts = [ "-o" "StrictHostKeyChecking=accept-new" ];
  autoRollback = true;
  magicRollback = true;

  nodes = {
    # Order matters: the Gitea Actions workflow invokes them in this sequence.
    # SSH/deploy targets use public hostnames because the Gitea runner is not on
    # the private network. Host-to-host traffic still uses the 10.0.0.0/8 IPs.
    # See the host address table in README.md.
    db-host     = mkNode "db-host"     "db.gebos.online";
    app-host    = mkNode "app-host"    "app.gebos.online";
    mqtt-ingest = mkNode "mqtt-ingest" "ingest.gebos.online";
  };
}