{
  description = "UltraCloud - Japanese Cloud Platform";

  # ============================================================================
  # INPUTS: External dependencies
  # ============================================================================
  inputs = {
    # Use unstable nixpkgs for latest packages
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";

    # Rust overlay for managing Rust toolchains
    rust-overlay = {
      url = "github:oxalica/rust-overlay";
      inputs.nixpkgs.follows = "nixpkgs";
    };

    # Flake utilities for multi-system support
    flake-utils.url = "github:numtide/flake-utils";

    # Disko for declarative disk partitioning
    disko = {
      url = "github:nix-community/disko";
      inputs.nixpkgs.follows = "nixpkgs";
    };

  };

  # ============================================================================
  # OUTPUTS: What this flake provides
  # ============================================================================
  outputs = { self, nixpkgs, rust-overlay, flake-utils, disko, systems ? null }:
    flake-utils.lib.eachDefaultSystem
      (system:
        let
          # Apply rust-overlay to get rust-bin attribute
          overlays = [ (import rust-overlay) ];

          pkgs = import nixpkgs {
            inherit system overlays;
          };

          # Rust toolchain configuration
          # Using stable channel with rust-src (for rust-analyzer) and rust-analyzer
          rustToolchain = pkgs.rust-bin.stable.latest.default.override {
            extensions = [ "rust-src" "rust-analyzer" ];
          };

          # Common build inputs needed by all Rust packages
          commonBuildInputs = with pkgs; [
            rocksdb # RocksDB storage engine
            openssl # TLS/SSL support
          ];

          # Common native build inputs (build-time only)
          commonNativeBuildInputs = with pkgs; [
            pkg-config # For finding libraries
            protobuf # Protocol Buffers compiler
            rustToolchain
          ];

          # Common environment variables for building
          commonEnvVars = {
            LIBCLANG_PATH = "${pkgs.llvmPackages.libclang.lib}/lib";
            PROTOC = "${pkgs.protobuf}/bin/protoc";
            ROCKSDB_LIB_DIR = "${pkgs.rocksdb}/lib";
          };

          clusterPython = pkgs.python3.withPackages (ps: [ ps.python-snappy ]);

          # Keep Rust package builds stable without invalidating every package on
          # unrelated workspace changes.
          workspaceSourceRoots = {
            chainfire = [ "chainfire" ];
            flaredb = [ "flaredb" ];
            iam = [
              "apigateway"
              "chainfire"
              "creditservice"
              "crates/photon-auth-client"
              "crates/photon-config"
              "crates/photon-runtime"
              "crates/photon-state"
              "flaredb"
              "iam"
            ];
            coronafs = [ "coronafs" ];
            plasmavmc = [
              "apigateway"
              "chainfire"
              "creditservice"
              "crates/photon-auth-client"
              "crates/photon-config"
              "crates/photon-runtime"
              "crates/photon-state"
              "flaredb"
              "iam"
              "lightningstor"
              "plasmavmc"
              "prismnet"
            ];
            prismnet = [
              "apigateway"
              "chainfire"
              "creditservice"
              "crates/photon-auth-client"
              "crates/photon-config"
              "crates/photon-runtime"
              "crates/photon-state"
              "flaredb"
              "iam"
              "prismnet"
            ];
            flashdns = [
              "apigateway"
              "chainfire"
              "creditservice"
              "crates/photon-auth-client"
              "crates/photon-config"
              "crates/photon-runtime"
              "crates/photon-state"
              "flashdns"
              "flaredb"
              "iam"
            ];
            fiberlb = [
              "apigateway"
              "chainfire"
              "creditservice"
              "crates/photon-auth-client"
              "crates/photon-config"
              "crates/photon-runtime"
              "crates/photon-state"
              "fiberlb"
              "flaredb"
              "iam"
            ];
            lightningstor = [
              "apigateway"
              "chainfire"
              "creditservice"
              "crates/photon-auth-client"
              "crates/photon-config"
              "crates/photon-runtime"
              "crates/photon-state"
              "flaredb"
              "iam"
              "lightningstor"
            ];
            nightlight = [ "nightlight" ];
            creditservice = [
              "apigateway"
              "chainfire"
              "creditservice"
              "crates/photon-auth-client"
              "crates/photon-config"
              "crates/photon-runtime"
              "crates/photon-state"
              "flaredb"
              "iam"
            ];
            apigateway = [
              "apigateway"
              "chainfire"
              "creditservice"
              "crates/photon-auth-client"
              "crates/photon-config"
              "crates/photon-runtime"
              "crates/photon-state"
              "flaredb"
              "iam"
            ];
            k8shost = [
              "apigateway"
              "chainfire"
              "creditservice"
              "crates/photon-auth-client"
              "crates/photon-config"
              "crates/photon-runtime"
              "crates/photon-state"
              "fiberlb"
              "flaredb"
              "flashdns"
              "iam"
              "k8shost"
              "lightningstor"
              "plasmavmc"
              "prismnet"
            ];
            deployer = [
              "apigateway"
              "chainfire"
              "creditservice"
              "crates/photon-auth-client"
              "crates/photon-config"
              "crates/photon-runtime"
              "crates/photon-state"
              "deployer"
              "fiberlb"
              "flaredb"
              "flashdns"
              "iam"
              "prismnet"
            ];
          };

          mkWorkspaceSrc = workspaceSubdir:
            let
              sourceRoots = workspaceSourceRoots.${workspaceSubdir} or [ workspaceSubdir ];
            in
            pkgs.lib.cleanSourceWith {
              src = ./.;
              filter = path: type:
                let
                  rel = pkgs.lib.removePrefix ((toString ./.) + "/") (toString path);
                in
                rel == ""
                || builtins.elem rel [ "flake.nix" "flake.lock" ]
                || builtins.any
                  (root:
                    rel == root
                    || pkgs.lib.hasPrefix "${root}/" rel
                    || pkgs.lib.hasPrefix "${rel}/" root
                  )
                  sourceRoots;
            };

          flakeBundleSrc = pkgs.lib.cleanSourceWith {
            src = ./.;
            filter = path: type:
              let
                rel = pkgs.lib.removePrefix ((toString ./.) + "/") (toString path);
                topLevel = builtins.head (pkgs.lib.splitString "/" rel);
                includedTopLevels = [
                  "apigateway"
                  "baremetal"
                  "chainfire"
                  "coronafs"
                  "crates"
                  "creditservice"
                  "deployer"
                  "fiberlb"
                  "flashdns"
                  "flaredb"
                  "iam"
                  "k8shost"
                  "lightningstor"
                  "mtls-agent"
                  "nightlight"
                  "nix"
                  "plasmavmc"
                  "prismnet"
                ];
                isTargetDir = builtins.match "(.*/)?target(/.*)?" rel != null;
              in
              !isTargetDir
              && (
                rel == ""
                || builtins.elem rel [ "flake.nix" "flake.lock" ]
                || builtins.elem topLevel includedTopLevels
              );
          };

          flakeInputsBlock = ''
            inputs = {
              # Use unstable nixpkgs for latest packages
              nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";

              # Rust overlay for managing Rust toolchains
              rust-overlay = {
                url = "github:oxalica/rust-overlay";
                inputs.nixpkgs.follows = "nixpkgs";
              };

              # Flake utilities for multi-system support
              flake-utils.url = "github:numtide/flake-utils";

              # Disko for declarative disk partitioning
              disko = {
                url = "github:nix-community/disko";
                inputs.nixpkgs.follows = "nixpkgs";
              };

            };
          '';

          bundledInputsBlock = ''
            inputs = {
              nixpkgs.url = "path:./.bundle-inputs/nixpkgs";

              rust-overlay = {
                url = "path:./.bundle-inputs/rust-overlay";
                inputs.nixpkgs.follows = "nixpkgs";
              };

              flake-utils = {
                url = "path:./.bundle-inputs/flake-utils";
                inputs.systems.follows = "systems";
              };

              systems.url = "path:./.bundle-inputs/systems";

              disko = {
                url = "path:./.bundle-inputs/disko";
                inputs.nixpkgs.follows = "nixpkgs";
              };

            };
          '';

          flakeHeaderBlock = ''
            # ============================================================================
            # INPUTS: External dependencies
            # ============================================================================
            inputs = {
              # Use unstable nixpkgs for latest packages
              nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";

              # Rust overlay for managing Rust toolchains
              rust-overlay = {
                url = "github:oxalica/rust-overlay";
                inputs.nixpkgs.follows = "nixpkgs";
              };

              # Flake utilities for multi-system support
              flake-utils.url = "github:numtide/flake-utils";

              # Disko for declarative disk partitioning
              disko = {
                url = "github:nix-community/disko";
                inputs.nixpkgs.follows = "nixpkgs";
              };

            };

            # ============================================================================
            # OUTPUTS: What this flake provides
            # ============================================================================
            outputs = { self, nixpkgs, rust-overlay, flake-utils, disko, systems ? null }:
          '';

          bundledHeaderBlock = ''
            # ============================================================================
            # INPUTS: External dependencies
            # ============================================================================
            inputs = {
              nixpkgs.url = "path:./.bundle-inputs/nixpkgs";

              rust-overlay = {
                url = "path:./.bundle-inputs/rust-overlay";
                inputs.nixpkgs.follows = "nixpkgs";
              };

              flake-utils = {
                url = "path:./.bundle-inputs/flake-utils";
                inputs.systems.follows = "systems";
              };

              systems.url = "path:./.bundle-inputs/systems";

              disko = {
                url = "path:./.bundle-inputs/disko";
                inputs.nixpkgs.follows = "nixpkgs";
              };

            };

            # ============================================================================
            # OUTPUTS: What this flake provides
            # ============================================================================
            outputs = { self, nixpkgs, rust-overlay, flake-utils, disko, systems ? null }:
          '';

          bundledFlakeNix =
            pkgs.writeText
              "ultracloud-bundled-flake.nix"
              (
                builtins.replaceStrings
                  [ flakeHeaderBlock ]
                  [ bundledHeaderBlock ]
                  (builtins.readFile ./flake.nix)
              );

          bundledFlakeHeaderFile =
            pkgs.writeText "ultracloud-bundled-flake-header" bundledHeaderBlock;

          baseFlakeLock = builtins.fromJSON (builtins.readFile ./flake.lock);

          bundleInputRelPaths = {
            nixpkgs = "./.bundle-inputs/nixpkgs";
            "rust-overlay" = "./.bundle-inputs/rust-overlay";
            "flake-utils" = "./.bundle-inputs/flake-utils";
            disko = "./.bundle-inputs/disko";
            systems = "./.bundle-inputs/systems";
          };

          fetchLockedInput =
            nodeName:
            let
              tree = builtins.fetchTree baseFlakeLock.nodes.${nodeName}.locked;
            in
            if builtins.isAttrs tree && tree ? outPath then tree.outPath else tree;

          vendoredFlakeInputs = {
            nixpkgs = fetchLockedInput "nixpkgs";
            "rust-overlay" = fetchLockedInput "rust-overlay";
            "flake-utils" = fetchLockedInput "flake-utils";
            disko = fetchLockedInput "disko";
            systems = fetchLockedInput "systems";
          };

          makeBundledLockNode =
            nodeName: relPath:
            let
              node = baseFlakeLock.nodes.${nodeName};
            in
            node
            // {
              locked = {
                type = "path";
                path = relPath;
              };
              original = {
                type = "path";
                path = relPath;
              };
            };

          bundledFlakeLock = baseFlakeLock // {
            nodes =
              baseFlakeLock.nodes
              // {
                root =
                  baseFlakeLock.nodes.root
                  // {
                    inputs =
                      baseFlakeLock.nodes.root.inputs
                      // {
                        systems = "systems";
                      };
                  };
                nixpkgs = makeBundledLockNode "nixpkgs" bundleInputRelPaths.nixpkgs;
                "rust-overlay" = makeBundledLockNode "rust-overlay" bundleInputRelPaths."rust-overlay";
                "flake-utils" = makeBundledLockNode "flake-utils" bundleInputRelPaths."flake-utils";
                disko = makeBundledLockNode "disko" bundleInputRelPaths.disko;
                systems = makeBundledLockNode "systems" bundleInputRelPaths.systems;
              };
          };

          bundledFlakeLockFile =
            pkgs.writeText "ultracloud-bundled-flake.lock" (builtins.toJSON bundledFlakeLock);

          inBundledEval = builtins.pathExists ./.bundle-eval-marker;

          bundledFlakeRootDrv = pkgs.runCommand "ultracloud-bundled-flake-root"
            {
              nativeBuildInputs = [
                pkgs.coreutils
                pkgs.python3
              ];
            } ''
            mkdir -p "$out"
            cp -a ${flakeBundleSrc}/. "$out"/
            chmod -R u+w "$out"
            touch "$out/.bundle-eval-marker"
            mkdir -p "$out/.bundle-inputs"
            cp -a ${vendoredFlakeInputs.nixpkgs} "$out/.bundle-inputs/nixpkgs"
            cp -a ${vendoredFlakeInputs."rust-overlay"} "$out/.bundle-inputs/rust-overlay"
            cp -a ${vendoredFlakeInputs."flake-utils"} "$out/.bundle-inputs/flake-utils"
            cp -a ${vendoredFlakeInputs.disko} "$out/.bundle-inputs/disko"
            cp -a ${vendoredFlakeInputs.systems} "$out/.bundle-inputs/systems"
            cp ${bundledFlakeLockFile} "$out/flake.lock"
            python3 - <<'PY' "$out/flake.nix" ${bundledFlakeHeaderFile}
            from pathlib import Path
            import re
            import sys

            flake_path = Path(sys.argv[1])
            header = Path(sys.argv[2]).read_text()
            source = flake_path.read_text()
            pattern = re.compile(
                r"  # ============================================================================\n"
                r"  # INPUTS: External dependencies\n"
                r"  # ============================================================================\n"
                r"  inputs = \{.*?\n"
                r"  # ============================================================================\n"
                r"  # OUTPUTS: What this flake provides\n"
                r"  # ============================================================================\n"
                r"  outputs = \{ self, nixpkgs, rust-overlay, flake-utils, disko, systems \? null \}:",
                re.S,
            )
            rewritten, count = pattern.subn(header.rstrip("\n"), source, count=1)
            if count != 1:
                raise SystemExit(f"expected to rewrite 1 flake header, rewrote {count}")
            flake_path.write_text(rewritten)
            PY
          '';

          bundledFlakeRoot =
            if inBundledEval then
              null
            else
              builtins.path {
                path = bundledFlakeRootDrv;
                name = "ultracloud-bundled-flake-root-src";
              };

          bundledFlakeRootNarHashFile =
            if inBundledEval then
              null
            else
              pkgs.runCommand "ultracloud-bundled-flake-root-narhash"
                {
                  nativeBuildInputs = [ pkgs.nix ];
                } ''
                ${pkgs.nix}/bin/nix \
                  --extra-experimental-features nix-command \
                  hash path --sri ${bundledFlakeRoot} \
                  | tr -d '\n' > "$out"
              '';

          bundledFlakeRootNarHash =
            if inBundledEval then
              null
            else
              builtins.readFile bundledFlakeRootNarHashFile;

          bundledFlake =
            if inBundledEval then
              null
            else
              builtins.getFlake (
                builtins.unsafeDiscardStringContext
                  "path:${toString bundledFlakeRoot}?narHash=${bundledFlakeRootNarHash}"
              );

          bundledVmSmokeTargetToplevel =
            if inBundledEval then
              null
            else
              bundledFlake.nixosConfigurations.vm-smoke-target.config.system.build.toplevel;

          # Helper function to build a Rust workspace package
          # Parameters:
          #   name: package name (e.g., "chainfire-server")
          #   workspaceSubdir: subdirectory containing Cargo.toml (e.g., "chainfire")
          #   mainCrate: optional main crate name if different from workspace
          #   description: package description for meta
          #   doCheck: whether to run tests during build (default: false)
          buildRustWorkspace = { name, workspaceSubdir, mainCrate ? null, description ? "", doCheck ? false }:
            pkgs.rustPlatform.buildRustPackage ({
              pname = name;
              version = "0.1.0";
              src = mkWorkspaceSrc workspaceSubdir;

              cargoLock = {
                lockFile = ./${workspaceSubdir}/Cargo.lock;
              };

              # Build from the workspace subdirectory
              buildAndTestSubdir = workspaceSubdir;

              # Copy Cargo.lock to root for nix validation (expects it at src root)
              postUnpack = ''
                cp $sourceRoot/${workspaceSubdir}/Cargo.lock $sourceRoot/Cargo.lock
              '';

              nativeBuildInputs = commonNativeBuildInputs;
              buildInputs = commonBuildInputs;

              # Set environment variables for build
              inherit (commonEnvVars) LIBCLANG_PATH PROTOC ROCKSDB_LIB_DIR;

              # Enable cargo tests during build (can be overridden per-package)
              inherit doCheck;

              # Test flags: run tests for the main crate only
              cargoTestFlags = pkgs.lib.optionals (mainCrate != null) [ "-p" mainCrate ];

              # Metadata for the package
              meta = with pkgs.lib; {
                description = description;
                homepage = "https://github.com/yourorg/ultracloud";
                license = licenses.asl20; # Apache 2.0
                maintainers = [ ];
                platforms = platforms.linux;
              };

              # Build only the server binary if mainCrate is specified
              # This avoids building test binaries and examples
            } // pkgs.lib.optionalAttrs (mainCrate != null) {
              cargoBuildFlags = [ "-p" mainCrate ];
            });

          # Helper function to build multiple binaries from the same workspace in
          # one cargo invocation. This is mainly used by the VM cluster builds so
          # a single host build can satisfy several services from the same
          # workspace.
          buildRustWorkspaceBundle = { name, workspaceSubdir, crates, description ? "", doCheck ? false }:
            pkgs.rustPlatform.buildRustPackage {
              pname = name;
              version = "0.1.0";
              src = mkWorkspaceSrc workspaceSubdir;

              cargoLock = {
                lockFile = ./${workspaceSubdir}/Cargo.lock;
              };

              buildAndTestSubdir = workspaceSubdir;

              postUnpack = ''
                cp $sourceRoot/${workspaceSubdir}/Cargo.lock $sourceRoot/Cargo.lock
              '';

              nativeBuildInputs = commonNativeBuildInputs;
              buildInputs = commonBuildInputs;

              inherit (commonEnvVars) LIBCLANG_PATH PROTOC ROCKSDB_LIB_DIR;
              inherit doCheck;

              cargoBuildFlags = pkgs.lib.concatMap (crate: [ "-p" crate ]) crates;

              meta = with pkgs.lib; {
                description = description;
                homepage = "https://github.com/yourorg/ultracloud";
                license = licenses.asl20;
                maintainers = [ ];
                platforms = platforms.linux;
              };
            };

        in
        {
          # ======================================================================
          # DEVELOPMENT SHELL: Drop-in replacement for shell.nix
          # ======================================================================
          devShells.default = pkgs.mkShell {
            name = "cloud-dev";

            buildInputs = with pkgs; [
              # Rust toolchain (replaces rustup/cargo/rustc from shell.nix)
              rustToolchain

              # Protocol Buffers
              protobuf

              # LLVM/Clang (for bindgen/clang-sys)
              llvmPackages.libclang
              llvmPackages.clang

              # Build essentials
              pkg-config
              openssl

              # Development tools
              git
              curl
              jq
              grpcurl
              openssh
              sshpass
              clusterPython
              qemu
              vde2
              bind

              # For RocksDB (chainfire dependency)
              rocksdb
            ];

            # Environment variables for clang-sys and other build tools
            LIBCLANG_PATH = "${pkgs.llvmPackages.libclang.lib}/lib";
            PROTOC = "${pkgs.protobuf}/bin/protoc";
            ROCKSDB_LIB_DIR = "${pkgs.rocksdb}/lib";

            shellHook = ''
              echo "Cloud Platform Development Environment"
              echo "======================================="
              echo "Rust: $(rustc --version)"
              echo "Protoc: $(protoc --version)"
              echo "Clang: $(clang --version | head -1)"
              echo ""
              echo "Environment variables set:"
              echo "  LIBCLANG_PATH=$LIBCLANG_PATH"
              echo "  PROTOC=$PROTOC"
              echo "  ROCKSDB_LIB_DIR=$ROCKSDB_LIB_DIR"
              echo ""
              echo "Available workspaces:"
              echo "  - chainfire (distributed cluster coordination store)"
              echo "  - flaredb (distributed SQL/KV database for metadata and tenant data)"
              echo "  - iam (identity & access management)"
              echo "  - plasmavmc (VM control plane)"
              echo "  - prismnet (SDN controller)"
              echo "  - flashdns (DNS server)"
              echo "  - fiberlb (load balancer)"
              echo "  - lightningstor (block storage)"
              echo "  - nightlight (metrics store)"
              echo "  - creditservice (quota & billing)"
              echo "  - k8shost (kubernetes hosting)"
            '';
          };

          # ======================================================================
          # PACKAGES: Buildable artifacts from each workspace
          # ======================================================================
          packages = {
            # --------------------------------------------------------------------
            # Chainfire: Distributed Cluster Coordination Store
            # --------------------------------------------------------------------
            chainfire-server = buildRustWorkspace {
              name = "chainfire-server";
              workspaceSubdir = "chainfire";
              mainCrate = "chainfire-server";
              description = "Distributed cluster coordination store with consensus, watches, and membership";
            };

            # --------------------------------------------------------------------
            # FlareDB: Distributed SQL/KV Database
            # --------------------------------------------------------------------
            flaredb-server = buildRustWorkspace {
              name = "flaredb-server";
              workspaceSubdir = "flaredb";
              mainCrate = "flaredb-server";
              description = "Distributed Postgres-like SQL/KV database for service metadata, tenant data, and DBaaS";
            };

            # --------------------------------------------------------------------
            # IAM: Identity and Access Management Service
            # --------------------------------------------------------------------
            iam-server = buildRustWorkspace {
              name = "iam-server";
              workspaceSubdir = "iam";
              mainCrate = "iam-server";
              description = "Identity and access management service with RBAC and multi-tenant support";
            };

            # --------------------------------------------------------------------
            # CoronaFS: Shared Block Volume Service
            # --------------------------------------------------------------------
            coronafs-server = buildRustWorkspace {
              name = "coronafs-server";
              workspaceSubdir = "coronafs";
              mainCrate = "coronafs-server";
              description = "Shared block volume service exporting raw VM volumes over NBD";
            };

            # --------------------------------------------------------------------
            # PlasmaVMC: Virtual Machine Control Plane
            # --------------------------------------------------------------------
            plasmavmc-server = buildRustWorkspace {
              name = "plasmavmc-server";
              workspaceSubdir = "plasmavmc";
              mainCrate = "plasmavmc-server";
              description = "Virtual machine control plane for managing compute instances";
            };

            # --------------------------------------------------------------------
            # PrismNet: Software-Defined Networking Controller
            # --------------------------------------------------------------------
            prismnet-server = buildRustWorkspace {
              name = "prismnet-server";
              workspaceSubdir = "prismnet";
              mainCrate = "prismnet-server";
              description = "Software-defined networking controller with OVN integration";
            };

            # --------------------------------------------------------------------
            # FlashDNS: High-Performance DNS Server
            # --------------------------------------------------------------------
            flashdns-server = buildRustWorkspace {
              name = "flashdns-server";
              workspaceSubdir = "flashdns";
              mainCrate = "flashdns-server";
              description = "High-performance DNS server with pattern-based reverse DNS";
            };

            # --------------------------------------------------------------------
            # FiberLB: Layer 4/7 Load Balancer
            # --------------------------------------------------------------------
            fiberlb-server = buildRustWorkspace {
              name = "fiberlb-server";
              workspaceSubdir = "fiberlb";
              mainCrate = "fiberlb-server";
              description = "Layer 4/7 load balancer for distributing traffic across services";
            };

            # --------------------------------------------------------------------
            # LightningStor: Block Storage Service
            # --------------------------------------------------------------------
            lightningstor-server = buildRustWorkspace {
              name = "lightningstor-server";
              workspaceSubdir = "lightningstor";
              mainCrate = "lightningstor-server";
              description = "Distributed block storage service for persistent volumes";
            };

            lightningstor-node = buildRustWorkspace {
              name = "lightningstor-node";
              workspaceSubdir = "lightningstor";
              mainCrate = "lightningstor-node";
              description = "LightningStor distributed storage node daemon";
            };

            lightningstor-workspace = buildRustWorkspaceBundle {
              name = "lightningstor-workspace";
              workspaceSubdir = "lightningstor";
              crates = [
                "lightningstor-server"
                "lightningstor-node"
              ];
              description = "Combined LightningStor server and node workspace build";
            };

            # --------------------------------------------------------------------
            # NightLight: Prometheus-compatible Metrics Store
            # --------------------------------------------------------------------
            nightlight-server = buildRustWorkspace {
              name = "nightlight-server";
              workspaceSubdir = "nightlight";
              mainCrate = "nightlight-server";
              description = "Prometheus-compatible metrics storage (NightLight)";
            };

            # --------------------------------------------------------------------
            # CreditService: Quota and Billing Controller
            # --------------------------------------------------------------------
            creditservice-server = buildRustWorkspace {
              name = "creditservice-server";
              workspaceSubdir = "creditservice";
              mainCrate = "creditservice-server";
              description = "Credit/quota management service with billing integration";
            };

            # --------------------------------------------------------------------
            # APIGateway: API Gateway Service
            # --------------------------------------------------------------------
            apigateway-server = buildRustWorkspace {
              name = "apigateway-server";
              workspaceSubdir = "apigateway";
              mainCrate = "apigateway-server";
              description = "API Gateway for UltraCloud services";
            };

            # --------------------------------------------------------------------
            # k8shost: Kubernetes Hosting Component
            # --------------------------------------------------------------------
            k8shost-server = buildRustWorkspace {
              name = "k8shost-server";
              workspaceSubdir = "k8shost";
              mainCrate = "k8shost-server";
              description = "Lightweight Kubernetes hosting with multi-tenant isolation";
            };

            # --------------------------------------------------------------------
            # Deployer: Bare-metal bootstrap orchestration service
            # --------------------------------------------------------------------
            deployer-server = buildRustWorkspace {
              name = "deployer-server";
              workspaceSubdir = "deployer";
              mainCrate = "deployer-server";
              description = "Node bootstrap and phone-home orchestration service";
            };

            deployer-ctl = buildRustWorkspace {
              name = "deployer-ctl";
              workspaceSubdir = "deployer";
              mainCrate = "deployer-ctl";
              description = "Declarative control utility for UltraCloud deployer state";
            };

            node-agent = buildRustWorkspace {
              name = "node-agent";
              workspaceSubdir = "deployer";
              mainCrate = "node-agent";
              description = "Node-local runtime agent for UltraCloud scheduled services";
            };

            nix-agent = buildRustWorkspace {
              name = "nix-agent";
              workspaceSubdir = "deployer";
              mainCrate = "nix-agent";
              description = "Node-local NixOS reconciliation agent for UltraCloud hosts";
            };

            ultracloud-reconciler = buildRustWorkspace {
              name = "ultracloud-reconciler";
              workspaceSubdir = "deployer";
              mainCrate = "ultracloud-reconciler";
              description = "Declarative reconciler for host rollouts and published resources";
            };

            ultracloudFlakeBundle = pkgs.runCommand "ultracloud-flake-bundle.tar.gz"
              {
                nativeBuildInputs = [
                  pkgs.coreutils
                  pkgs.gnutar
                  pkgs.gzip
                ];
              } ''
              bundle_root="$(mktemp -d)"
              cp -a ${bundledFlakeRootDrv}/. "$bundle_root"/
              chmod -R u+w "$bundle_root"

              tar \
                --sort=name \
                --mtime='@1' \
                --owner=0 \
                --group=0 \
                --numeric-owner \
                -C "$bundle_root" \
                -cf - . \
                | gzip -n > "$out"
            '';

            # --------------------------------------------------------------------
            # Fleet Scheduler: Non-Kubernetes service scheduler for bare-metal nodes
            # --------------------------------------------------------------------
            fleet-scheduler = buildRustWorkspace {
              name = "fleet-scheduler";
              workspaceSubdir = "deployer";
              mainCrate = "fleet-scheduler";
              description = "Label-aware service scheduler for UltraCloud bare-metal fleets";
            };

            deployer-workspace = buildRustWorkspaceBundle {
              name = "deployer-workspace";
              workspaceSubdir = "deployer";
              crates = [
                "deployer-server"
                "deployer-ctl"
                "node-agent"
                "nix-agent"
                "ultracloud-reconciler"
                "fleet-scheduler"
              ];
              description = "Combined deployer workspace build for cluster images and checks";
            };

            vmClusterDeployerState =
              self.nixosConfigurations.node01.config.system.build.ultracloudDeployerClusterState;

            vmClusterFlakeBundle = self.packages.${system}.ultracloudFlakeBundle;
            vmSmokeBundledTargetToplevel = bundledVmSmokeTargetToplevel;

            # --------------------------------------------------------------------
            # Default package: Build all servers
            # --------------------------------------------------------------------
            default = pkgs.symlinkJoin {
              name = "ultracloud-all";
              paths = [
                self.packages.${system}.chainfire-server
                self.packages.${system}.flaredb-server
                self.packages.${system}.iam-server
                self.packages.${system}.plasmavmc-server
                self.packages.${system}.prismnet-server
                self.packages.${system}.flashdns-server
                self.packages.${system}.fiberlb-server
                self.packages.${system}.lightningstor-workspace
                self.packages.${system}.nightlight-server
                self.packages.${system}.creditservice-server
                self.packages.${system}.apigateway-server
                self.packages.${system}.k8shost-server
                self.packages.${system}.deployer-workspace
                self.packages.${system}.vmClusterDeployerState
              ];
            };

            single-node-quickstart-vm =
              self.nixosConfigurations.single-node-quickstart.config.system.build.vm;

            single-node-quickstart = pkgs.writeShellApplication {
              name = "single-node-quickstart";
              runtimeInputs = with pkgs; [
                coreutils
                findutils
                netcat
                openssh
                procps
                sshpass
              ];
              text = ''
                set -euo pipefail

                STATE_DIR="''${ULTRACLOUD_QUICKSTART_STATE_DIR:-$HOME/.ultracloud-single-node-quickstart}"
                RUN_DIR="$STATE_DIR/run"
                DISK_IMAGE="$STATE_DIR/quickstart.qcow2"
                PID_FILE="$STATE_DIR/qemu.pid"
                SERIAL_LOG="$STATE_DIR/serial.log"
                SSH_PORT="''${ULTRACLOUD_QUICKSTART_SSH_PORT:-22220}"
                KEEP_VM="''${ULTRACLOUD_QUICKSTART_KEEP_VM:-0}"
                REUSE_DISK="''${ULTRACLOUD_QUICKSTART_REUSE_DISK:-0}"
                VM_PATH="${self.packages.${system}.single-node-quickstart-vm}"
                RUN_VM="$(find "$VM_PATH/bin" -maxdepth 1 -name 'run-*-vm' | head -n1)"

                log() {
                  printf '[single-node-quickstart] %s\n' "$*"
                }

                dump_serial() {
                  if [ -f "$SERIAL_LOG" ]; then
                    log "serial log tail:"
                    tail -n 120 "$SERIAL_LOG" >&2 || true
                  fi
                }

                cleanup() {
                  if [ -f "$PID_FILE" ]; then
                    pid="$(cat "$PID_FILE")"
                    if kill -0 "$pid" >/dev/null 2>&1; then
                      kill "$pid" >/dev/null 2>&1 || true
                      for _ in $(seq 1 30); do
                        if ! kill -0 "$pid" >/dev/null 2>&1; then
                          break
                        fi
                        sleep 1
                      done
                    fi
                    rm -f "$PID_FILE"
                  fi
                }

                on_exit() {
                  status="$?"
                  if [ "$status" -ne 0 ]; then
                    dump_serial
                  fi
                  if [ "$KEEP_VM" != "1" ]; then
                    cleanup
                  fi
                  exit "$status"
                }

                wait_for_ssh() {
                  local deadline=$((SECONDS + 240))
                  while true; do
                    if sshpass -p ultracloud ssh \
                      -F /dev/null \
                      -o StrictHostKeyChecking=no \
                      -o UserKnownHostsFile=/dev/null \
                      -o LogLevel=ERROR \
                      -o ConnectTimeout=5 \
                      -o ConnectionAttempts=1 \
                      -p "$SSH_PORT" \
                      root@127.0.0.1 true >/dev/null 2>&1; then
                      return 0
                    fi
                    if [ "$SECONDS" -ge "$deadline" ]; then
                      log "timed out waiting for SSH on port $SSH_PORT"
                      return 1
                    fi
                    sleep 1
                  done
                }

                wait_for_unit_active() {
                  local unit="$1"
                  local deadline=$((SECONDS + 240))
                  while true; do
                    if ssh_cmd systemctl is-active "$unit" >/dev/null 2>&1; then
                      return 0
                    fi
                    if [ "$SECONDS" -ge "$deadline" ]; then
                      log "timed out waiting for $unit"
                      ssh_cmd systemctl status "$unit" --no-pager || true
                      return 1
                    fi
                    sleep 1
                  done
                }

                ssh_cmd() {
                  sshpass -p ultracloud ssh \
                    -F /dev/null \
                    -o StrictHostKeyChecking=no \
                    -o UserKnownHostsFile=/dev/null \
                    -o LogLevel=ERROR \
                    -o ConnectTimeout=5 \
                    -o ConnectionAttempts=1 \
                    -p "$SSH_PORT" \
                    root@127.0.0.1 -- "$@"
                }

                ssh_shell() {
                  local script="$1"
                  local quoted
                  printf -v quoted '%q' "$script"
                  sshpass -p ultracloud ssh \
                    -F /dev/null \
                    -o StrictHostKeyChecking=no \
                    -o UserKnownHostsFile=/dev/null \
                    -o LogLevel=ERROR \
                    -o ConnectTimeout=5 \
                    -o ConnectionAttempts=1 \
                    -p "$SSH_PORT" \
                    root@127.0.0.1 "bash -lc $quoted"
                }

                trap on_exit EXIT

                [ -n "$RUN_VM" ] || {
                  log "failed to locate run-*-vm under $VM_PATH/bin"
                  exit 1
                }

                mkdir -p "$STATE_DIR"
                rm -rf "$RUN_DIR"
                mkdir -p "$RUN_DIR"
                rm -f "$SERIAL_LOG"
                if [ "$REUSE_DISK" != "1" ]; then
                  rm -f "$DISK_IMAGE"
                fi

                cleanup

                log "launching single-node quickstart VM"
                nohup env \
                  USE_TMPDIR=1 \
                  TMPDIR="$RUN_DIR" \
                  NIX_DISK_IMAGE="$DISK_IMAGE" \
                  QEMU_NET_OPTS="hostfwd=tcp:127.0.0.1:$SSH_PORT-:22" \
                  "$RUN_VM" >"$SERIAL_LOG" 2>&1 &
                echo "$!" > "$PID_FILE"

                log "waiting for guest SSH"
                wait_for_ssh

                log "waiting for in-guest readiness gate"
                wait_for_unit_active ultracloud-single-node-quickstart-ready.service

                log "verifying required services"
                ssh_cmd systemctl is-active chainfire flaredb iam prismnet plasmavmc >/dev/null

                log "verifying service health endpoints and VM runtime prerequisites"
                ssh_shell 'curl -fsS http://127.0.0.1:8081/health >/dev/null && curl -fsS http://127.0.0.1:8082/health >/dev/null && curl -fsS http://127.0.0.1:8083/health >/dev/null && curl -fsS http://127.0.0.1:8087/health >/dev/null && curl -fsS http://127.0.0.1:8084/health >/dev/null && test -x /run/current-system/sw/bin/qemu-system-x86_64 && test -x /run/current-system/sw/bin/qemu-img && test -c /dev/net/tun'

                log "single-node quickstart smoke passed"

                if [ "$KEEP_VM" = "1" ]; then
                  trap - EXIT
                  log "VM left running"
                  log "ssh: sshpass -p ultracloud ssh -p $SSH_PORT root@127.0.0.1"
                  exit 0
                fi
              '';
            };
          };

          # ======================================================================
          # APPS: Runnable applications from packages
          # ======================================================================
          apps = {
            chainfire-server = flake-utils.lib.mkApp {
              drv = self.packages.${system}.chainfire-server;
            };

            flaredb-server = flake-utils.lib.mkApp {
              drv = self.packages.${system}.flaredb-server;
            };

            iam-server = flake-utils.lib.mkApp {
              drv = self.packages.${system}.iam-server;
            };

            plasmavmc-server = flake-utils.lib.mkApp {
              drv = self.packages.${system}.plasmavmc-server;
            };

            prismnet-server = flake-utils.lib.mkApp {
              drv = self.packages.${system}.prismnet-server;
            };

            flashdns-server = flake-utils.lib.mkApp {
              drv = self.packages.${system}.flashdns-server;
            };

            fiberlb-server = flake-utils.lib.mkApp {
              drv = self.packages.${system}.fiberlb-server;
            };

            lightningstor-server = flake-utils.lib.mkApp {
              drv = self.packages.${system}.lightningstor-server;
            };

            lightningstor-node = flake-utils.lib.mkApp {
              drv = self.packages.${system}.lightningstor-node;
            };

            nightlight-server = flake-utils.lib.mkApp {
              drv = self.packages.${system}.nightlight-server;
            };

            creditservice-server = flake-utils.lib.mkApp {
              drv = self.packages.${system}.creditservice-server;
            };

            apigateway-server = flake-utils.lib.mkApp {
              drv = self.packages.${system}.apigateway-server;
            };

            k8shost-server = flake-utils.lib.mkApp {
              drv = self.packages.${system}.k8shost-server;
            };

            deployer-server = flake-utils.lib.mkApp {
              drv = self.packages.${system}.deployer-server;
            };

            deployer-ctl = flake-utils.lib.mkApp {
              drv = self.packages.${system}.deployer-ctl;
            };

            ultracloud-reconciler = flake-utils.lib.mkApp {
              drv = self.packages.${system}.ultracloud-reconciler;
            };

            nix-agent = flake-utils.lib.mkApp {
              drv = self.packages.${system}.nix-agent;
            };

            node-agent = flake-utils.lib.mkApp {
              drv = self.packages.${system}.node-agent;
            };

            fleet-scheduler = flake-utils.lib.mkApp {
              drv = self.packages.${system}.fleet-scheduler;
            };

            single-node-quickstart = flake-utils.lib.mkApp {
              drv = self.packages.${system}.single-node-quickstart;
            };

            all-in-one-quickstart = flake-utils.lib.mkApp {
              drv = self.packages.${system}.single-node-quickstart;
            };
          };

          checks =
            let
              stripKvmRequiredSystemFeature = drv:
                drv.overrideTestDerivation (old: {
                  requiredSystemFeatures =
                    builtins.filter (feature: feature != "kvm") (old.requiredSystemFeatures or [ ]);
                });

              canonicalProfileEvalData = {
                single-node-quickstart = {
                  hostName = self.nixosConfigurations.single-node-quickstart.config.networking.hostName;
                  stateVersion =
                    self.nixosConfigurations.single-node-quickstart.config.system.stateVersion;
                };
                node01 = {
                  hostName = self.nixosConfigurations.node01.config.networking.hostName;
                  stateVersion = self.nixosConfigurations.node01.config.system.stateVersion;
                };
                node02 = {
                  hostName = self.nixosConfigurations.node02.config.networking.hostName;
                  stateVersion = self.nixosConfigurations.node02.config.system.stateVersion;
                };
                node03 = {
                  hostName = self.nixosConfigurations.node03.config.networking.hostName;
                  stateVersion = self.nixosConfigurations.node03.config.system.stateVersion;
                };
                netboot-control-plane = {
                  hostName = self.nixosConfigurations.netboot-control-plane.config.networking.hostName;
                  stateVersion =
                    self.nixosConfigurations.netboot-control-plane.config.system.stateVersion;
                };
                netboot-worker = {
                  hostName = self.nixosConfigurations.netboot-worker.config.networking.hostName;
                  stateVersion =
                    self.nixosConfigurations.netboot-worker.config.system.stateVersion;
                };
                netboot-all-in-one = {
                  hostName = self.nixosConfigurations.netboot-all-in-one.config.networking.hostName;
                  stateVersion =
                    self.nixosConfigurations.netboot-all-in-one.config.system.stateVersion;
                };
                ultracloud-iso = {
                  hostName = self.nixosConfigurations.ultracloud-iso.config.networking.hostName;
                  imageFileName = self.nixosConfigurations.ultracloud-iso.config.image.fileName;
                };
                baremetal-qemu-control-plane = {
                  hostName =
                    self.nixosConfigurations.baremetal-qemu-control-plane.config.networking.hostName;
                  stateVersion =
                    self.nixosConfigurations.baremetal-qemu-control-plane.config.system.stateVersion;
                };
                baremetal-qemu-worker = {
                  hostName = self.nixosConfigurations.baremetal-qemu-worker.config.networking.hostName;
                  stateVersion =
                    self.nixosConfigurations.baremetal-qemu-worker.config.system.stateVersion;
                };
              };
            in
            {
            workspace-source-roots-audit = pkgs.runCommand "workspace-source-roots-audit"
              {
                nativeBuildInputs = [ pkgs.python3 ];
              } ''
              ${pkgs.python3}/bin/python - <<'PY' ${./.}
              from __future__ import annotations

              import re
              import sys
              import tomllib
              from pathlib import Path
              from typing import Any


              def extract_workspace_source_roots(flake_path: Path) -> dict[str, list[str]]:
                  source = flake_path.read_text()
                  match = re.search(r"workspaceSourceRoots\s*=\s*\{(.*?)\n\s*\};", source, re.S)
                  if match is None:
                      raise ValueError(f"Could not find workspaceSourceRoots in {flake_path}")

                  roots: dict[str, list[str]] = {}
                  for name, body in re.findall(r"\n\s*(\w+)\s*=\s*\[(.*?)\];", match.group(1), re.S):
                      roots[name] = re.findall(r'"([^"]+)"', body)
                  return roots


              def collect_path_dependencies(value: Any) -> list[str]:
                  found: list[str] = []

                  if isinstance(value, dict):
                      path = value.get("path")
                      if isinstance(path, str):
                          found.append(path)
                      for nested in value.values():
                          found.extend(collect_path_dependencies(nested))
                  elif isinstance(value, list):
                      for nested in value:
                          found.extend(collect_path_dependencies(nested))

                  return found


              def workspace_manifests(repo_root: Path, workspace_name: str) -> list[Path]:
                  workspace_manifest = repo_root / workspace_name / "Cargo.toml"
                  manifests = [workspace_manifest]
                  workspace_data = tomllib.loads(workspace_manifest.read_text())
                  members = workspace_data.get("workspace", {}).get("members", [])

                  for member in members:
                      for candidate in workspace_manifest.parent.glob(member):
                          manifest = candidate if candidate.name == "Cargo.toml" else candidate / "Cargo.toml"
                          if manifest.is_file():
                              manifests.append(manifest)

                  unique_manifests: list[Path] = []
                  seen: set[Path] = set()
                  for manifest in manifests:
                      resolved = manifest.resolve()
                      if resolved in seen:
                          continue
                      seen.add(resolved)
                      unique_manifests.append(manifest)
                  return unique_manifests


              def required_root(dep_rel: Path) -> str:
                  parts = dep_rel.parts
                  if not parts:
                      return ""
                  if parts[0] == "crates" and len(parts) >= 2:
                      return "/".join(parts[:2])
                  return parts[0]


              def is_covered(dep_rel: str, configured_roots: list[str]) -> bool:
                  return any(dep_rel == root or dep_rel.startswith(f"{root}/") for root in configured_roots)


              def main() -> int:
                  repo_root = Path(sys.argv[1]).resolve()
                  workspace_roots = extract_workspace_source_roots(repo_root / "flake.nix")
                  failures: list[str] = []

                  for workspace_name, configured_roots in sorted(workspace_roots.items()):
                      workspace_manifest = repo_root / workspace_name / "Cargo.toml"
                      if not workspace_manifest.is_file():
                          continue

                      for manifest in workspace_manifests(repo_root, workspace_name):
                          manifest_data = tomllib.loads(manifest.read_text())
                          for dep_path in collect_path_dependencies(manifest_data):
                              dependency_dir = (manifest.parent / dep_path).resolve()
                              try:
                                  dep_rel = dependency_dir.relative_to(repo_root)
                              except ValueError:
                                  continue

                              dep_rel_str = dep_rel.as_posix()
                              if is_covered(dep_rel_str, configured_roots):
                                  continue

                              failures.append(
                                  f"{workspace_name}: missing source root '{required_root(dep_rel)}' "
                                  f"for dependency '{dep_rel_str}' referenced by "
                                  f"{manifest.relative_to(repo_root).as_posix()}"
                              )

                  if failures:
                      print("workspaceSourceRoots is missing path dependencies:", file=sys.stderr)
                      for failure in failures:
                          print(f"  - {failure}", file=sys.stderr)
                      return 1

                  print("workspaceSourceRoots covers all workspace path dependencies.")
                  return 0


              raise SystemExit(main())
              PY
              touch "$out"
            '';

            canonical-profile-eval-guards = pkgs.writeText "canonical-profile-eval-guards.json"
              (builtins.toJSON canonicalProfileEvalData);

            canonical-profile-build-guards = pkgs.linkFarm "canonical-profile-build-guards" [
              {
                name = "single-node-quickstart-vm";
                path = self.packages.${system}.single-node-quickstart-vm;
              }
              {
                name = "node01-toplevel";
                path = self.nixosConfigurations.node01.config.system.build.toplevel;
              }
              {
                name = "node02-toplevel";
                path = self.nixosConfigurations.node02.config.system.build.toplevel;
              }
              {
                name = "node03-toplevel";
                path = self.nixosConfigurations.node03.config.system.build.toplevel;
              }
              {
                name = "netboot-control-plane-toplevel";
                path = self.nixosConfigurations.netboot-control-plane.config.system.build.toplevel;
              }
              {
                name = "netboot-worker-toplevel";
                path = self.nixosConfigurations.netboot-worker.config.system.build.toplevel;
              }
              {
                name = "netboot-all-in-one-toplevel";
                path = self.nixosConfigurations.netboot-all-in-one.config.system.build.toplevel;
              }
              {
                name = "ultracloud-iso-image";
                path = self.nixosConfigurations.ultracloud-iso.config.system.build.isoImage;
              }
              {
                name = "baremetal-qemu-control-plane-toplevel";
                path = self.nixosConfigurations.baremetal-qemu-control-plane.config.system.build.toplevel;
              }
              {
                name = "baremetal-qemu-worker-toplevel";
                path = self.nixosConfigurations.baremetal-qemu-worker.config.system.build.toplevel;
              }
            ];

            portable-control-plane-regressions =
              pkgs.linkFarm "portable-control-plane-regressions" [
                {
                  name = "canonical-profile-eval-guards";
                  path = self.checks.${system}.canonical-profile-eval-guards;
                }
                {
                  name = "deployer-bootstrap-e2e";
                  path = self.checks.${system}.deployer-bootstrap-e2e;
                }
                {
                  name = "host-lifecycle-e2e";
                  path = self.checks.${system}.host-lifecycle-e2e;
                }
                {
                  name = "deployer-vm-smoke";
                  path = self.checks.${system}.deployer-vm-smoke;
                }
                {
                  name = "fleet-scheduler-e2e";
                  path = self.checks.${system}.fleet-scheduler-e2e;
                }
              ];

            first-boot-topology-vm-smoke = pkgs.testers.runNixOSTest (
              import ./nix/tests/first-boot-topology-vm-smoke.nix {
                inherit pkgs;
                ultracloudPackages = self.packages.${system};
                ultracloudModule = self.nixosModules.default;
              }
            );

            deployer-vm-smoke = stripKvmRequiredSystemFeature (pkgs.testers.runNixOSTest (
              import ./nix/tests/deployer-vm-smoke.nix {
                inherit pkgs;
                ultracloudPackages = self.packages.${system};
                smokeTargetToplevel = self.packages.${system}.vmSmokeBundledTargetToplevel;
              }
            ));

            deployer-vm-rollback = stripKvmRequiredSystemFeature (pkgs.testers.runNixOSTest (
              import ./nix/tests/deployer-vm-smoke.nix {
                inherit pkgs;
                ultracloudPackages = self.packages.${system};
                smokeTargetToplevel = self.packages.${system}.vmSmokeBundledTargetToplevel;
                desiredSystemOverrides = {
                  health_check_command = [ "false" ];
                  rollback_on_failure = true;
                };
                expectedStatus = "rolled-back";
                expectCurrentSystemMatchesTarget = false;
                expectMarkerPresent = false;
              }
            ));

            baremetal-iso-e2e = pkgs.runCommand "baremetal-iso-e2e"
              {
                nativeBuildInputs = with pkgs; [
                  bash
                  coreutils
                  curl
                  findutils
                  gawk
                  gnugrep
                  gnused
                  iproute2
                  jq
                  nix
                  openssh
                  procps
                  python3
                  qemu
                ];
                preferLocalBuild = true;
                allowSubstitutes = false;
                ULTRACLOUD_BAREMETAL_ISO_IMAGE =
                  "${self.nixosConfigurations.ultracloud-iso.config.system.build.isoImage}";
                ULTRACLOUD_BAREMETAL_FLAKE_BUNDLE =
                  "${self.packages.${system}.ultracloudFlakeBundle}";
                ULTRACLOUD_BAREMETAL_CONTROL_TARGET =
                  "${self.nixosConfigurations.baremetal-qemu-control-plane.config.system.build.toplevel}";
                ULTRACLOUD_BAREMETAL_WORKER_TARGET =
                  "${self.nixosConfigurations.baremetal-qemu-worker.config.system.build.toplevel}";
                ULTRACLOUD_BAREMETAL_CONTROL_DISKO_SCRIPT =
                  "${self.nixosConfigurations.baremetal-qemu-control-plane.config.system.build.formatMount}";
                ULTRACLOUD_BAREMETAL_WORKER_DISKO_SCRIPT =
                  "${self.nixosConfigurations.baremetal-qemu-worker.config.system.build.formatMount}";
                ULTRACLOUD_BAREMETAL_CACHE_REGISTRATION = "${pkgs.closureInfo {
                  rootPaths = [
                    self.nixosConfigurations.baremetal-qemu-control-plane.config.system.build.toplevel
                    self.nixosConfigurations.baremetal-qemu-worker.config.system.build.toplevel
                    self.nixosConfigurations.baremetal-qemu-control-plane.config.system.build.formatMount
                    self.nixosConfigurations.baremetal-qemu-worker.config.system.build.formatMount
                  ];
                }}";
                ULTRACLOUD_CHAINFIRE_SERVER_BIN =
                  "${self.packages.${system}.chainfire-server}/bin/chainfire";
                ULTRACLOUD_DEPLOYER_SERVER_BIN =
                  "${self.packages.${system}.deployer-server}/bin/deployer-server";
                ULTRACLOUD_DEPLOYER_CTL_BIN =
                  "${self.packages.${system}.deployer-ctl}/bin/deployer-ctl";
                ULTRACLOUD_OVMF_CODE = "${pkgs.OVMF.fd}/FV/OVMF_CODE.fd";
                ULTRACLOUD_OVMF_VARS = "${pkgs.OVMF.fd}/FV/OVMF_VARS.fd";
                ULTRACLOUD_QEMU_BIN = "${pkgs.qemu}/bin/qemu-system-x86_64";
                ULTRACLOUD_QEMU_IMG_BIN = "${pkgs.qemu}/bin/qemu-img";
                ULTRACLOUD_REPO_ROOT = "${self}";
                NIX_CONFIG = "experimental-features = nix-command flakes";
              } ''
              export HOME="$TMPDIR/home"
              mkdir -p "$HOME"
              export NIX_CONFIG="$NIX_CONFIG"
              export PATH="${pkgs.lib.makeBinPath [
                pkgs.bash
                pkgs.coreutils
                pkgs.curl
                pkgs.findutils
                pkgs.gawk
                pkgs.gnugrep
                pkgs.gnused
                pkgs.iproute2
                pkgs.jq
                pkgs.nix
                pkgs.openssh
                pkgs.procps
                pkgs.python3
                pkgs.qemu
              ]}"
              bash ${./nix/test-cluster/verify-baremetal-iso.sh}
              touch "$out"
            '';

            fiberlb-native-bgp-vm-smoke = pkgs.testers.runNixOSTest (
              import ./nix/tests/fiberlb-native-bgp-vm-smoke.nix {
                inherit pkgs;
                ultracloudPackages = self.packages.${system};
                ultracloudModule = self.nixosModules.default;
              }
            );

            fiberlb-native-bgp-multipath-vm-smoke = pkgs.testers.runNixOSTest (
              import ./nix/tests/fiberlb-native-bgp-multipath-vm-smoke.nix {
                inherit pkgs;
                ultracloudPackages = self.packages.${system};
                ultracloudModule = self.nixosModules.default;
              }
            );

            fiberlb-native-bgp-interop-vm-smoke = pkgs.testers.runNixOSTest (
              import ./nix/tests/fiberlb-native-bgp-interop-vm-smoke.nix {
                inherit pkgs;
                ultracloudPackages = self.packages.${system};
                ultracloudModule = self.nixosModules.default;
              }
            );

            fiberlb-native-bgp-ecmp-drain-vm-smoke = pkgs.testers.runNixOSTest (
              import ./nix/tests/fiberlb-native-bgp-ecmp-drain-vm-smoke.nix {
                inherit pkgs;
                ultracloudPackages = self.packages.${system};
                ultracloudModule = self.nixosModules.default;
              }
            );

            deployer-bootstrap-e2e = pkgs.runCommand "deployer-bootstrap-e2e"
              {
                nativeBuildInputs = with pkgs; [
                  bash
                  coreutils
                  curl
                  findutils
                  gawk
                  gnugrep
                  gnused
                  procps
                  python3
                ];
                ULTRACLOUD_E2E_IN_NIX = "1";
                ULTRACLOUD_CHAINFIRE_SERVER_BIN =
                  "${self.packages.${system}.chainfire-server}/bin/chainfire";
                ULTRACLOUD_DEPLOYER_SERVER_BIN =
                  "${self.packages.${system}.deployer-workspace}/bin/deployer-server";
                ULTRACLOUD_DEPLOYER_CTL_BIN =
                  "${self.packages.${system}.deployer-workspace}/bin/deployer-ctl";
              } ''
              export HOME="$TMPDIR/home"
              mkdir -p "$HOME"
              export PATH="${pkgs.lib.makeBinPath [
                pkgs.bash
                pkgs.coreutils
                pkgs.curl
                pkgs.findutils
                pkgs.gawk
                pkgs.gnugrep
                pkgs.gnused
                pkgs.procps
                pkgs.python3
              ]}"
              bash ${./deployer/scripts/verify-deployer-bootstrap-e2e.sh}
              touch "$out"
            '';

            host-lifecycle-e2e = pkgs.runCommand "host-lifecycle-e2e"
              {
                nativeBuildInputs = with pkgs; [
                  bash
                  coreutils
                  curl
                  findutils
                  gawk
                  gnugrep
                  gnused
                  procps
                  python3
                ];
                ULTRACLOUD_E2E_IN_NIX = "1";
                ULTRACLOUD_CHAINFIRE_SERVER_BIN =
                  "${self.packages.${system}.chainfire-server}/bin/chainfire";
                ULTRACLOUD_DEPLOYER_CTL_BIN =
                  "${self.packages.${system}.deployer-workspace}/bin/deployer-ctl";
                ULTRACLOUD_RECONCILER_BIN =
                  "${self.packages.${system}.deployer-workspace}/bin/ultracloud-reconciler";
              } ''
              export HOME="$TMPDIR/home"
              mkdir -p "$HOME"
              export PATH="${pkgs.lib.makeBinPath [
                pkgs.bash
                pkgs.coreutils
                pkgs.curl
                pkgs.findutils
                pkgs.gawk
                pkgs.gnugrep
                pkgs.gnused
                pkgs.procps
                pkgs.python3
              ]}"
              bash ${./deployer/scripts/verify-host-lifecycle-e2e.sh}
              touch "$out"
            '';

            fleet-scheduler-e2e = pkgs.runCommand "fleet-scheduler-e2e"
              {
                nativeBuildInputs = with pkgs; [
                  bash
                  coreutils
                  curl
                  findutils
                  gawk
                  gnugrep
                  gnused
                  procps
                  python3
                ];
                ULTRACLOUD_E2E_IN_NIX = "1";
                ULTRACLOUD_CHAINFIRE_SERVER_BIN =
                  "${self.packages.${system}.chainfire-server}/bin/chainfire";
                ULTRACLOUD_DEPLOYER_CTL_BIN =
                  "${self.packages.${system}.deployer-workspace}/bin/deployer-ctl";
                ULTRACLOUD_NODE_AGENT_BIN =
                  "${self.packages.${system}.deployer-workspace}/bin/node-agent";
                ULTRACLOUD_FLEET_SCHEDULER_BIN =
                  "${self.packages.${system}.deployer-workspace}/bin/fleet-scheduler";
              } ''
              export HOME="$TMPDIR/home"
              mkdir -p "$HOME"
              export PATH="${pkgs.lib.makeBinPath [
                pkgs.bash
                pkgs.coreutils
                pkgs.curl
                pkgs.findutils
                pkgs.gawk
                pkgs.gnugrep
                pkgs.gnused
                pkgs.procps
                pkgs.python3
              ]}"
              bash ${./deployer/scripts/verify-fleet-scheduler-e2e.sh}
              touch "$out"
            '';
          };
        }
      ) // {
      # ========================================================================
      # NIXOS MODULES: System-level service modules (non-system-specific)
      # ========================================================================
      nixosModules.default = import ./nix/modules;

      nixosModules.ultracloud = import ./nix/modules;

      # ========================================================================
      # NIXOS CONFIGURATIONS: Netboot images for bare-metal provisioning
      # ========================================================================
      nixosConfigurations =
        let
          vmClusterLib = import ./nix/nodes/vm-cluster/lib.nix { lib = nixpkgs.lib; };
          overlayModule = {
            nixpkgs.overlays = [ self.overlays.default ];
          };
          mkVmClusterSystem = nodeName:
            nixpkgs.lib.nixosSystem {
              system = "x86_64-linux";
              modules = [
                disko.nixosModules.disko
                vmClusterLib.nodeConfigurationPaths.${nodeName}
                self.nixosModules.default
                (vmClusterLib.mkBootstrapServicesModule {
                  inherit self nodeName;
                  enableDeployer = nodeName == vmClusterLib.bootstrapNodeName;
                })
                { nixpkgs.overlays = [ self.overlays.default ]; }
              ];
            };
        in
        {
          # Control Plane netboot image (all 8 services)
          netboot-control-plane = nixpkgs.lib.nixosSystem {
            system = "x86_64-linux";
            modules = [
              ./nix/images/netboot-control-plane.nix
              overlayModule
            ];
          };

          # Worker netboot image (compute-focused services)
          netboot-worker = nixpkgs.lib.nixosSystem {
            system = "x86_64-linux";
            modules = [
              ./nix/images/netboot-worker.nix
              overlayModule
            ];
          };

          # All-in-One netboot image (single-node deployment)
          netboot-all-in-one = nixpkgs.lib.nixosSystem {
            system = "x86_64-linux";
            modules = [
              ./nix/images/netboot-all-in-one.nix
              overlayModule
            ];
          };

          # QEMU-first single-node quickstart for one-command local bring-up.
          single-node-quickstart = nixpkgs.lib.nixosSystem {
            system = "x86_64-linux";
            modules = [
              ./nix/single-node/qemu-vm.nix
              ./nix/single-node/base.nix
              self.nixosModules.default
              overlayModule
              {
                ultracloud.quickstart.enable = true;
              }
            ];
          };

          # Canonical bare-metal ISO install targets used by the QEMU proof path.
          baremetal-qemu-control-plane = nixpkgs.lib.nixosSystem {
            system = "x86_64-linux";
            modules = [
              disko.nixosModules.disko
              ./nix/nodes/baremetal-qemu/control-plane/configuration.nix
              ./nix/nodes/baremetal-qemu/control-plane/disko.nix
              self.nixosModules.default
              overlayModule
            ];
          };

          baremetal-qemu-worker = nixpkgs.lib.nixosSystem {
            system = "x86_64-linux";
            modules = [
              disko.nixosModules.disko
              ./nix/nodes/baremetal-qemu/worker/configuration.nix
              ./nix/nodes/baremetal-qemu/worker/disko.nix
              self.nixosModules.default
              overlayModule
            ];
          };

          # Base netboot image (minimal, for VM testing and provisioning)
          netboot-base = nixpkgs.lib.nixosSystem {
            system = "x86_64-linux";
            modules = [
              ./nix/images/netboot-base.nix
              overlayModule
            ];
          };

          # Offline-friendly target used by deployer VM smoke tests.
          vm-smoke-target = nixpkgs.lib.nixosSystem {
            system = "x86_64-linux";
            modules = [ ./nix/images/deployer-vm-smoke-target.nix ];
          };

          # UltraCloud ISO (T061.S5 - bootable ISO with cluster-config embedding)
          ultracloud-iso = nixpkgs.lib.nixosSystem {
            system = "x86_64-linux";
            specialArgs = {
              ultracloudBaremetalFormatMountPaths = {
                baremetal-qemu-control-plane =
                  self.nixosConfigurations."baremetal-qemu-control-plane".config.system.build.formatMount;
                baremetal-qemu-worker =
                  self.nixosConfigurations."baremetal-qemu-worker".config.system.build.formatMount;
              };
              ultracloudBaremetalSystemPaths = {
                baremetal-qemu-control-plane =
                  self.nixosConfigurations."baremetal-qemu-control-plane".config.system.build.toplevel;
                baremetal-qemu-worker =
                  self.nixosConfigurations."baremetal-qemu-worker".config.system.build.toplevel;
              };
            };
            modules = [
              ./nix/iso/ultracloud-iso.nix
              self.nixosModules.default
              { nixpkgs.overlays = [ self.overlays.default ]; }
            ];
          };

          # T036 VM Cluster Nodes (for nixos-anywhere deployment)
          pxe-server = nixpkgs.lib.nixosSystem {
            system = "x86_64-linux";
            modules = [
              disko.nixosModules.disko
              ./baremetal/vm-cluster/pxe-server/configuration.nix
              ./baremetal/vm-cluster/pxe-server/disko.nix
              self.nixosModules.default
              { nixpkgs.overlays = [ self.overlays.default ]; }
            ];
          };
        }
        // nixpkgs.lib.genAttrs vmClusterLib.controlPlaneNodeNames mkVmClusterSystem;

      # ========================================================================
      # OVERLAY: Provides UltraCloud packages to nixpkgs
      # ========================================================================
      # Usage in NixOS configuration:
      #   nixpkgs.overlays = [ inputs.ultracloud.overlays.default ];
      overlays.default = final: prev: {
        chainfire-server = self.packages.${final.system}.chainfire-server;
        flaredb-server = self.packages.${final.system}.flaredb-server;
        iam-server = self.packages.${final.system}.iam-server;
        coronafs-server = self.packages.${final.system}.coronafs-server;
        plasmavmc-server = self.packages.${final.system}.plasmavmc-server;
        prismnet-server = self.packages.${final.system}.prismnet-server;
        flashdns-server = self.packages.${final.system}.flashdns-server;
        fiberlb-server = self.packages.${final.system}.fiberlb-server;
        lightningstor-workspace = self.packages.${final.system}.lightningstor-workspace;
        lightningstor-server = self.packages.${final.system}.lightningstor-workspace;
        lightningstor-node = self.packages.${final.system}.lightningstor-workspace;
        nightlight-server = self.packages.${final.system}.nightlight-server;
        creditservice-server = self.packages.${final.system}.creditservice-server;
        apigateway-server = self.packages.${final.system}.apigateway-server;
        k8shost-server = self.packages.${final.system}.k8shost-server;
        deployer-workspace = self.packages.${final.system}.deployer-workspace;
        deployer-server = self.packages.${final.system}.deployer-server;
        deployer-ctl = self.packages.${final.system}.deployer-ctl;
        ultracloud-reconciler = self.packages.${final.system}.ultracloud-reconciler;
        ultracloudFlakeBundle = self.packages.${final.system}.ultracloudFlakeBundle;
        nix-agent = self.packages.${final.system}.nix-agent;
        node-agent = self.packages.${final.system}.node-agent;
        fleet-scheduler = self.packages.${final.system}.fleet-scheduler;
      };
    };
}
