{
  description = "Nix configurations for iscg infra hosts (muscari k3s + future rosemary backup + future poppy darwin)";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";

    sops-nix = {
      url = "github:Mic92/sops-nix";
      inputs.nixpkgs.follows = "nixpkgs";
    };
  };

  outputs = { self, nixpkgs, sops-nix, ... }:
  let
    system = "x86_64-linux";

    mkHost = hostname: nixpkgs.lib.nixosSystem {
      inherit system;
      modules = [
        ./hosts/common
        ./hosts/${hostname}
        sops-nix.nixosModules.sops
        {
          # SOPS для каждого хоста: secrets/<hostname>.yaml
          # приватный age-ключ лежит в /etc/sops/age/keys.txt (chmod 600)
          sops.defaultSopsFile = ./secrets/${hostname}.yaml;
          sops.age.sshKeyPaths = [ "/etc/sops/age/keys.txt" ];
        }
      ];
    };
  in
  {
    nixosConfigurations = {
      muscari = mkHost "muscari";
      # rosemary = mkHost "rosemary";  # раскомментировать когда будет backup VM
    };
  };
}