{
  description = "someone flake configuration based on hjem";

  outputs = inputs:
    inputs.flake-parts.lib.mkFlake {inherit inputs;} {
      systems = ["x86_64-linux" "aarch64-linux"];

      imports = [./hosts ./pkgs inputs.git-hooks-nix.flakeModule];

      perSystem = {
        config,
        pkgs,
        ...
      }: {
        devShells = {
          default = pkgs.mkShell {
            packages = [pkgs.alejandra pkgs.git config.packages.repl];
            name = "someone";
            DIRENV_LOG_FORMAT = "";
          };
        };
        # Nix Formatter
        formatter = pkgs.alejandra;

        # Pre-commit hooks (flake-parts module from cachix/git-hooks.nix).
        # `nix build .#checks.<system>.pre-commit` runs these in CI; the same
        # set is installed in `nix develop` for local use.
        # alejandra.settings.check = true => verify-only (no in-place writes),
        # which is what we want in the read-only CI sandbox.
        pre-commit.settings.hooks = {
          alejandra = {
            enable = true;
            settings.check = true;
          };
          statix = {
            enable = true;
            # hardware-configuration.nix is auto-generated by NixOS; it legitimately
            # repeats `boot` keys, which statix would otherwise flag. Exclude it here.
            settings.ignore = ["hardware-configuration.nix"];
            # Lint config (statix.toml at repo root). Disables `empty_pattern`, which
            # flags the standard NixOS `{ ... }:` module pattern that nixpkgs likewise
            # permits.
            settings.config = "./statix.toml";
          };
          deadnix.enable = true;
          actionlint.enable = true;
          trim-trailing-whitespace.enable = true;
          end-of-file-fixer.enable = true;
          check-yaml.enable = true;
          check-toml.enable = true;
          check-added-large-files.enable = true;
          check-merge-conflicts.enable = true;
          detect-private-keys.enable = true;
        };
      };
    };

  inputs = {
    # global, so they can be `.follow`ed
    systems.url = "github:nix-systems/default-linux";

    flake-compat.url = "github:edolstra/flake-compat";

    flake-utils = {
      url = "github:numtide/flake-utils";
      inputs.systems.follows = "systems";
    };

    flake-parts = {
      url = "github:hercules-ci/flake-parts";
      inputs.nixpkgs-lib.follows = "nixpkgs";
    };

    # Nix-native pre-commit framework (maintained successor to
    # pre-commit-hooks.nix). Follows our nixpkgs to avoid version skew
    # with the rest of the flake.
    git-hooks-nix = {
      url = "github:cachix/git-hooks.nix";
      inputs.nixpkgs.follows = "nixpkgs";
    };

    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";

    # rest of inputs, alphabetical order
    import-tree.url = "github:vic/import-tree";

    zen-browser = {
      url = "github:youwen5/zen-browser-flake";
      inputs.nixpkgs.follows = "nixpkgs";
    };

    helium = {
      url = "github:schembriaiden/helium-browser-nix-flake";
      inputs.nixpkgs.follows = "nixpkgs";
    };

    himmelblau = {
      url = "github:himmelblau-idm/himmelblau/main";
      inputs.nixpkgs.follows = "nixpkgs";
    };

    mdatp = {
      url = "github:epetousis/nix-mdatp";
      inputs.nixpkgs.follows = "nixpkgs";
    };

    rustlock = {
      url = "github:JorySeverijnse/rustlock";
      inputs.nixpkgs.follows = "nixpkgs";
    };

    nix-index-db = {
      url = "github:Mic92/nix-index-database";
      inputs.nixpkgs.follows = "nixpkgs";
    };

    # --- Server (hetzner) inputs ---
    # Pinned to 24.05 to match the deployed Hetzner server exactly.
    nixos-24-05 = {
      url = "github:NixOS/nixpkgs/nixos-24.05";
    };

    nixpkgs-unstable = {
      url = "github:NixOS/nixpkgs/nixos-unstable";
    };

    disko = {
      url = "github:nix-community/disko";
      inputs.nixpkgs.follows = "nixos-24-05";
    };

    sops-nix = {
      url = "github:Mic92/sops-nix";
      inputs.nixpkgs.follows = "nixos-24-05";
    };
  };
}