{ inputs }:

let
  mkNode = name: hostname: {
    inherit hostname;
    sshUser = "deploy";
    user = "root";
    profiles.system = {
      path = inputs.deploy-rs.lib.x86_64-linux.activate.nixos
        inputs.self.nixosConfigurations.${name};
    };
  };
in
{
  # The Gitea runner has a global `Host * IdentityFile ~/.ssh/larsnolden` in its
  # ~/.ssh/config (a passphrase-locked key). `-F none` makes ssh ignore that
  # config so it doesn't offer the wrong key; `-i` + IdentitiesOnly pins the
  # dedicated deploy key the workflow installs. Applies to both `nix copy` and
  # the activation SSH.
  sshOpts = [
    "-F" "none"
    "-i" "~/.ssh/gebos_deploy"
    "-o" "IdentitiesOnly=yes"
    "-o" "StrictHostKeyChecking=accept-new"
  ];
  autoRollback = true;
  magicRollback = true;

  nodes = {
    # Order matters: the Gitea Actions workflow invokes them in this sequence.
    # SSH/deploy targets use public hostnames because the Gitea runner is not on
    # the private network. Host-to-host traffic still uses the 10.0.0.0/8 IPs.
    # See the host address table in README.md.
    db-host     = mkNode "db-host"     "db.gebos.online";
    app-host    = mkNode "app-host"    "app.gebos.online";
    mqtt-ingest = mkNode "mqtt-ingest" "ingest.gebos.online";
  };
}