{
  uterranix-lib,
  pkgs,
}: {
  name,
  image,
  flake ? "$FLAKE_ROOT",
  hosts ? [],
}: {
  lib,
  config,
  ...
}: let
  inherit
    (uterranix-lib)
    tf
    ;
  inherit
    (lib)
    singleton
    concatMapStringsSep
    ;
in {
  data."external"."nixng-image-${name}" = {
    program = singleton (pkgs.writeShellScript "build_nixng_image_${name}.sh" ''
      set -euo pipefail

      echo '{"out":"${image}"}'
    '');
  };

  resource."terraform_data"."nixng-image-${name}-copy" = {
    triggers_replace = [
      (tf "data.external.nixng-image-${name}.result.out")
    ];
    provisioner."local-exec" = {
      interpreter = [
        (pkgs.writeShellScript "copy_nixng_image_${name}.sh" ''
          set -euo pipefail

          _system_path="/$(cut -f '2-' -d '/' <<<"$1")"

          cd $FLAKE_ROOT
          mkdir -p /tmp/terranix
          ${concatMapStringsSep "\n" (host: ''
              flock -x /tmp/terranix/${host} nix copy "$_system_path" --to ssh-ng://${host} -s --no-check-sigs
            '')
            hosts}

        '')
        (tf "data.external.nixng-image-${name}.result.out")
      ];
      command = "ignoreme";
    };
  };
}