{
  description = "Project-agnostic NixOS EC2 AMI with ZFS /nix support";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
  };

  outputs = { self, nixpkgs, ... }:
    let
      supportedSystems = [ "aarch64-linux" "x86_64-linux" ];
      forAllSystems = f:
        nixpkgs.lib.genAttrs supportedSystems (system: f system);
      mkConfig = system:
        nixpkgs.lib.nixosSystem {
          inherit system;
          modules = [
            self.nixosModules.zfsNixStore
            ./nixos/baseline.nix
          ];
        };
    in
    {
      nixosConfigurations = {
        baseline-aarch64-linux = mkConfig "aarch64-linux";
        baseline-x86_64-linux = mkConfig "x86_64-linux";
      };

      packages = forAllSystems (system:
        let
          pkgs = import nixpkgs { inherit system; };
          config = self.nixosConfigurations."baseline-${system}".config;
          ami-artifacts-script = pkgs.stdenvNoCC.mkDerivation {
            pname = "ami-artifacts-script";
            version = "0.1.0";
            src = ./manage-amis.ts;
            nativeBuildInputs = [ pkgs.esbuild ];
            dontUnpack = true;
            buildPhase = ''
              runHook preBuild
              esbuild "$src" \
                --bundle \
                --platform=node \
                --target=node24 \
                --format=esm \
                --outfile=manage-amis.mjs
              runHook postBuild
            '';
            installPhase = ''
              runHook preInstall
              install -Dm755 manage-amis.mjs "$out/libexec/ami-artifacts/manage-amis.mjs"
              runHook postInstall
            '';
          };
          ami-artifacts = pkgs.writeShellApplication {
            name = "ami-artifacts";
            runtimeInputs = [
              pkgs.awscli2
              pkgs.git
              pkgs.nodejs_24
              pkgs.opentofu
            ];
            text = ''
              git_root="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
              if [ -d "$git_root/tofu/ami-builder" ]; then
                repo_root="$git_root"
                ami_builder_dir="$git_root/tofu/ami-builder"
              else
                repo_root="$(cd "$git_root/../.." && pwd)"
                ami_builder_dir="$git_root"
              fi
              export QUIXOS_REPO_ROOT="$repo_root"
              export QUIXOS_AMI_BUILDER_DIR="$ami_builder_dir"
              exec ${pkgs.nodejs_24}/bin/node ${ami-artifacts-script}/libexec/ami-artifacts/manage-amis.mjs "$@"
            '';
          };
          publish-ami = pkgs.writeShellApplication {
            name = "publish-ami";
            runtimeInputs = [
              pkgs.awscli2
              pkgs.coreutils
              pkgs.git
              pkgs.jq
              pkgs.opentofu
            ];
            text = ''
              git_root="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
              if [ -d "$git_root/tofu/ami-builder" ]; then
                ami_builder_dir="$git_root/tofu/ami-builder"
              else
                ami_builder_dir="$git_root"
              fi
              cd "$ami_builder_dir"
              exec ./publish-ami.sh "$@"
            '';
          };
        in
        {
          rootImage = config.system.build.images.amazon;
          systemClosure = config.system.build.toplevel;
          ami-artifacts = ami-artifacts;
          publish-ami = publish-ami;
          default = ami-artifacts;
        });

      apps = forAllSystems (system: {
        ami-artifacts = {
          type = "app";
          program = "${self.packages.${system}.ami-artifacts}/bin/ami-artifacts";
        };
        publish-ami = {
          type = "app";
          program = "${self.packages.${system}.publish-ami}/bin/publish-ami";
        };
      });

      nixosModules.zfsNixStore = import ./nixos/modules/zfs-nix-store.nix;
    };
}