{
  description = "Flake for server muffin";

  inputs = {
    # nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
    nixpkgs.url = "github:NixOS/nixpkgs/master";

    nixos-hardware.url = "github:NixOS/nixos-hardware/master";

    quadlet-nix.url = "github:SEIAROTg/quadlet-nix";
    quadlet-nix.inputs.nixpkgs.follows = "nixpkgs";

    nix-minecraft.url = "github:Infinidoge/nix-minecraft";
    nix-minecraft.inputs.nixpkgs.follows = "nixpkgs";

    vpn-confinement.url = "github:Maroka-chan/VPN-Confinement";

    nixpkgs-qbt.url = "github:NixOS/nixpkgs/pull/287923/head";
  };

  outputs =
    {
      nixpkgs,
      quadlet-nix,
      nix-minecraft,
      nixos-hardware,
      vpn-confinement,
      nixpkgs-qbt,
      ...
    }@inputs:
    let
      username = "primary";
      hostname = "muffin";
      eth_interface = "enp3s0";

      service_configs = {
        hdd_path = "/mnt/hdd";
        services_dir = "/tank/services";

        # TODO: add checks to make sure none of these collide
        ports = {
          https = 443;
          jellyfin = 8096; # no services.jellyfin option for this
          torrent = 6011;
          ollama = 11434;
          bitmagnet = 3333;
        };

        https = {
          certs = service_configs.services_dir + "/http_certs";
          data_dir = service_configs.services_dir + "/http";
        };

        gitea = {
          dir = service_configs.services_dir + "/gitea";
          domain = "git.gardling.com";
        };

        postgres = {
          socket = "/run/postgresql";
        };

        immich = {
          dir = service_configs.services_dir + "/immich";
        };

        minecraft = {
          parent_dir = service_configs.services_dir + "/minecraft";
          server_name = "main";
        };

        gluetun = {
          dir = service_configs.services_dir + "/gluetun";
        };

        torrent = {
          config_dir = service_configs.services_dir + "/qbittorrent/config";
          download_dir = service_configs.hdd_path + "/torrents";
        };

        jellyfin = {
          dir = service_configs.services_dir + "/jellyfin";
        };

        ollama = {
          data_dir = service_configs.services_dir + "/ollama";
        };
      };
    in
    {
      nixosConfigurations.${hostname} = nixpkgs.lib.nixosSystem {
        specialArgs = {
          inherit
            username
            hostname
            eth_interface
            service_configs
            inputs
            ;
        };
        modules = [
          ./configuration.nix
          quadlet-nix.nixosModules.quadlet
          nixos-hardware.nixosModules.common-cpu-amd-pstate
          nixos-hardware.nixosModules.common-cpu-amd-zenpower
          nixos-hardware.nixosModules.common-pc-ssd
          nixos-hardware.nixosModules.common-gpu-intel

          vpn-confinement.nixosModules.default

          # import the `services.qbittorrent` module
          (nixpkgs-qbt + "/nixos/modules/services/torrent/qbittorrent.nix")

          (
            { pkgs, lib, ... }:
            {
              imports = [ nix-minecraft.nixosModules.minecraft-servers ];
              nixpkgs.overlays = [ nix-minecraft.overlay ];
            }
          )
        ];
      };
    };
}