{ inputs ? rec {
    nixpkgs.lib = import <nixpkgs/lib> // {
      nixosSystem = import <nixpkgs/nixos/lib/eval-config.nix>;
    };

    stockholm.overlays.default = import <stockholm/krebs/5pkgs>;
    stockholm.inputs.nix-writers = <stockholm/submodules/nix-writers>;
    stockholm.nixosModules =
      let
        inherit (nixpkgs) lib;
      in builtins.listToAttrs
        (map
          # to preserve the file name for debugability, don't import here
          (name: {name = lib.removeSuffix ".nix" name; value = (<stockholm/krebs/3modules> + "/${name}");})
          (lib.filter
            (name: name != "default.nix" && !lib.hasPrefix "." name)
            (lib.attrNames (builtins.readDir <stockholm/krebs/3modules>))));
  }
, extraModules ? []
}: {
    nixosConfigurations =
      inputs.nixpkgs.lib.mapAttrs
        (name: _: let
          minimal.enable =
            name == "oai";

          system = (import ./systems/${name}/spec.nix).system;
        in
          inputs.nixpkgs.lib.nixosSystem {
            inherit system;
            specialArgs = rec {
              inherit inputs;

              lib = inputs.nixpkgs.lib // {
                # for stockholm.
                # without it krebs.hosts.*.nets.*.prefix breaks for ne
                # due to patched types.
                slib = mylib;
              };

              mylib = (import ./. { inherit lib; }).mylib // {
                importSecret =
                  p: _: {};
              };
            };
            modules = [
              ({ lib, ... }: {
                _file = "${toString ./legacy.nix} #1";
                imports = lib.optionals minimal.enable [
                  (./systems + "/${name}/config.nix")
                ];
              })
              ({ lib, mylib, ... }: {
                _file = "${toString ./legacy.nix} #2";
                imports = lib.optionals (!minimal.enable) [
                  (./systems + "/${name}/config.nix")
                  (let dirt = ./systems + "/${name}/dirt"; in
                    if builtins.pathExists dirt then dirt else {})
                  {
                    _file = "${toString ./legacy.nix} #2.1";
                    imports = [
                      inputs.stockholm.nixosModules.build
                      inputs.stockholm.nixosModules.dns
                      inputs.stockholm.nixosModules.exim
                      inputs.stockholm.nixosModules.exim-retiolum
                      inputs.stockholm.nixosModules.exim-smarthost
                      inputs.stockholm.nixosModules.github
                      inputs.stockholm.nixosModules.hosts
                      inputs.stockholm.nixosModules.htgen
                      inputs.stockholm.nixosModules.kartei
                      inputs.stockholm.nixosModules.krebs
                      inputs.stockholm.nixosModules.nixpkgs
                      inputs.stockholm.nixosModules.on-failure
                      inputs.stockholm.nixosModules.iana-etc
                      inputs.stockholm.nixosModules.per-user
                      inputs.stockholm.nixosModules.permown
                      inputs.stockholm.nixosModules.repo-sync
                      inputs.stockholm.nixosModules.secret
                      inputs.stockholm.nixosModules.setuid
                      inputs.stockholm.nixosModules.shadow
                      inputs.stockholm.nixosModules.sitemap
                      inputs.stockholm.nixosModules.ssh
                      inputs.stockholm.nixosModules.systemd
                      inputs.stockholm.nixosModules.tinc
                      inputs.stockholm.nixosModules.users
                      inputs.stockholm.nixosModules.zones
                    ];
                    nixpkgs.overlays = [
                      (import (inputs.stockholm.inputs.nix-writers + "/pkgs"))
                      (self: super: {
                        stockholm.lib.types = lib.types // {
                          inherit (mylib.types)
                            hostname
                            secret-file
                            ;
                        };
                        inherit (inputs.stockholm.overlays.default self super)
                          brain
                          cgit-clear-cache
                          git-hooks
                          htgen
                          htgen-imgur
                          htgen-paste
                          irc-announce
                          painload
                          repo-sync
                          ;
                      })
                    ];
                  }
                  ./configs
                  ./modules
                  { imports = extraModules; }
                  # This must come before <stockholm/krebs>. And before means after, `imports`-wise.
                  ({ inputs, mylib, ... }: {
                    nixpkgs.overlays = [
                      (self: super: {
                        inherit mylib;
                      })

                      (import (inputs.stockholm.inputs.nix-writers + "/pkgs"))

                      (import ./pkgs)
                    ];
                  })
                ];
              })
            ];
          }
        )
        (builtins.readDir ./systems);
}