{inputs, ...}: let
  inherit
    (inputs)
    self
    ;
in {
  perSystem = {
    system,
    pkgs,
    ...
  }: {
    devShells.default = let
      unpackSrc = package:
        pkgs.stdenv.mkDerivation {
          pname = package.pname;
          version = package.version;

          src = package.src;

          phases = ["unpackPhase" "installPhase"];

          installPhase = ''
            mkdir $out
            cp -r . $out
          '';
        };
      prepareDeps = pkgs.writeShellScript "prepare-deps.sh" ''
        cd "$(git rev-parse --show-toplevel)/home-manager/modules/xmonad"
        mkdir -p .packages

        _rsync_args=("--no-perms" "--no-owner" "--no-group" "--del" "--exclude=.stack-work" "--chmod=ugo=rwX" "-crvP")
        rsync "''${_rsync_args[@]}" ${unpackSrc pkgs.haskell.packages.ghc946.xmonad}/. .packages/xmonad >/dev/null 2>&1
        rsync "''${_rsync_args[@]}" ${unpackSrc pkgs.haskell.packages.ghc946.xmonad-contrib}/. .packages/xmonad-contrib >/dev/null 2>&1
        rsync "''${_rsync_args[@]}" ${unpackSrc pkgs.haskell.packages.ghc946.xmobar}/. .packages/xmobar >/dev/null 2>&1
      '';
      stack-wrapped = pkgs.symlinkJoin {
        name = "stack"; # will be available as the usual `stack` in terminal
        paths = [pkgs.stack];
        buildInputs = [pkgs.makeWrapper];
        postBuild = ''
          wrapProgram $out/bin/stack \
            --run "${prepareDeps}"\
            --add-flags "\
              --no-nix \
              --system-ghc \
              --no-install-ghc \
            "
        '';
      };

      inherit
        (pkgs.callPackage ../scripts/nix-secret-wrapper {})
        nixos-rebuild
        nix
        ;

      nix-verify =
        pkgs.callPackage ../scripts/nix-verify {};
    in
      pkgs.mkShell {
        shellHook = ''
          ${self.checks.${system}.pre-commit-check.shellHook}
        '';

        nativeBuildInputs = with pkgs;
          [
            (pkgs.writeShellScriptBin "update-secret" ''
              nix flake lock --update-input secret
            '')
            nil
            nix
            nixos-rebuild
            nix-verify
            (pkgs.callPackage inputs.nix-fast-build.packages.${pkgs.stdenv.system}.nix-fast-build.override {})
            # nix-eval-jobs doesn't like our nix version, don't override it then
            (inputs.nix-eval-jobs.packages.${pkgs.stdenv.system}.nix-eval-jobs)
            (nomad.overrideAttrs (old: {meta = old.meta // {license = "mpl-2.0";};}))
            (consul.overrideAttrs (old: {meta = old.meta // {license = "mpl-2.0";};}))
            (vault.overrideAttrs (old: {meta = old.meta // {license = "mpl-2.0";};}))

            kubectl
            kubeconform

            gcc-arm-embedded-9
            haskell.compiler.ghc946
            stack-wrapped
            pkg-config
            haskell.packages.ghc946.haskell-language-server
            jq
            alejandra
            (inputs.uk3s-nix.legacyPackages.${system}.helm2nixScript {
              name = "base";
              charts = [
                # {
                #   helmChart = pkgs.istioctl.src + "/manifests/charts/base";
                #   name = "istio-base";
                #   namespace = "istio-system";
                #   values = {
                #     defaultRevision = "foo";
                #   };
                # }
                # {
                #   helmChart = pkgs.istioctl.src + "/manifests/charts/istio-operator";
                #   name = "istio-operator";
                #   namespace = "istio-system";
                #   values = {
                #     enableCRDTemplates = true;
                #     revision = "foo";
                #   };
                # }
                # {
                #   helmChart =
                #     (pkgs.fetchFromGitHub {
                #       owner = "metallb";
                #       repo = "metallb";
                #       rev = "v0.14.3";
                #       hash = "sha256-H9F2g4N/RGeMViPpK9jiJG1ABI8luFmfk6d2mjQobKQ=";
                #     })
                #     + "/charts/metallb";
                #   name = "metallb";
                #   namespace = "metallb-system";
                #   values = {
                #   };
                # }
              ];
              target = "./terranix/kubernetes/generated/";
            })
          ]
          ++ (lib.foldl (acc: x: acc ++ x) [] (map (x: pkgs.haskell.packages.ghc946.${x}.buildInputs) ["gi-pangocairo" "X11" "cairo" "glib"]));
      };
  };
}