let
  sources = import ./nix/sources.nix;

  krops = sources.krops;
  lib = import "${krops}/lib";
  kropsPkgs = import "${krops}/pkgs" { };

  kropsDeploy =
    { hostname
    , target ? null
    , secrets ? true
    , extraSources ? { }
    }:
    let
      source = lib.evalSource [
        {
          nixpkgs.git = {
            ref = sources.nixpkgs.rev;
            url = https://github.com/NixOS/nixpkgs;
            shallow = true;
          };
          nixos-hardware.git = {
            ref = sources.nixos-hardware.rev;
            url = https://github.com/NixOS/nixos-hardware;
          };
          config.file = {
            path = toString ./.;
            filters = [
              {
                type = "exclude";
                pattern = ".git";
              }
              {
                type = "exclude";
                pattern = "*.qcow2";
              }
              {
                type = "include";
                pattern = "/machines/${hostname}/";
              }
              {
                type = "exclude";
                pattern = "/machines/*/";
              }
            ];
          };
          nixos-config.symlink = "config/machines/${hostname}/configuration.nix";
        }
        (lib.mkIf secrets {
          secrets.pass = {
            dir = toString ~/.password-store;
            name = "nixos/machines/${hostname}";
          };
        })
        extraSources
      ];
    in
    kropsPkgs.krops.writeDeploy "deploy-${hostname}" {
      source = source;
      target = lib.mkTarget target // {
        extraOptions = [
          # force allocation of tty to allow aborting with ^C and to show build progress
          "-t"
        ];
      };
    };
in
lib.mapAttrs
  (hostname: configuration: kropsDeploy ({ inherit hostname; } // configuration))
  (import ./machines)