{
  description = "Flowback infra (NixOS): Nextcloud + Forgejo, staging + production";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";

    # Optional, but strongly recommended for secrets:
    sops-nix.url = "github:Mic92/sops-nix";
    sops-nix.inputs.nixpkgs.follows = "nixpkgs";
  };

  outputs = { self, nixpkgs, sops-nix, ... }:
  let
    mkHost = { name, system, modules }:
      nixpkgs.lib.nixosSystem {
        inherit system;
        modules =
          modules ++ [
            sops-nix.nixosModules.sops
          ];
        specialArgs = { inherit name; };
      };
  in
  {
    # Staging host (x86_64 for VM/cloud)
    nixosConfigurations.staging = mkHost {
      name = "staging";
      system = "x86_64-linux";
      modules = [
        ./hosts/staging/configuration.nix
      ];
    };

    # Production host (x86_64 for VM/cloud)
    nixosConfigurations.production = mkHost {
      name = "production";
      system = "x86_64-linux";
      modules = [
        ./hosts/production/configuration.nix
      ];
    };

    # Raspberry Pi example (aarch64) — use when you’re ready
    # nixosConfigurations.rpi-staging = mkHost {
    #   name = "rpi-staging";
    #   system = "aarch64-linux";
    #   modules = [
    #     ./hosts/staging/configuration.nix
    #     ./hosts/staging/rpi-hardware.nix
    #   ];
    # };
  };
}