{
  description = "Tools for general use around h8s";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
    flake-utils.url = "github:numtide/flake-utils";
  };

  outputs =
    {
      self,
      nixpkgs,
      flake-utils,
      ...
    }:
    flake-utils.lib.eachDefaultSystem (
      system:
      let
        pkgs = nixpkgs.legacyPackages.${system};
        tools = with pkgs; [
          kubectl
          kubernetes-helm
          talosctl
          argocd
          cilium-cli
          go-task
          jq
          opentofu
          yq
          sshpass
          netcat
          authelia
          sops
          openssl
          age
          age-plugin-fido2-hmac
          pam_u2f
        ];
      in
      {
        devShells.default = pkgs.mkShell {
          buildInputs = tools;
          shellHook = ''
            export PROJECT_ROOT="$(git rev-parse --show-toplevel 2>/dev/null)"
            export TF_VAR_project_root=$PROJECT_ROOT
            export INFRA_ROOT=$PROJECT_ROOT/infrastructure
            export TF_VAR_infra_root=$INFRA_ROOT
          '';
        };

        devShells.infra = pkgs.mkShell {
          inputsFrom = [ self.devShells.${system}.default ];
          SOPS_AGE_KEY_CMD = ''
            bash -c 'grep -lZF -- "# public key: $SOPS_AGE_RECIPIENT" "$H8S_SECRETS_DIR"/keys/age/* | xargs -0r cat'
          '';
          shellHook = ''
            export H8S_SECRETS_DIR="''${H8S_SECRETS_DIR:-$PROJECT_ROOT/../h8s-secrets}"
            h8s_exports="$(sops exec-env --pristine "$H8S_SECRETS_DIR/secrets.yaml" 'export -p')" || exit 1
            eval "$h8s_exports" 2>/dev/null || exit 1
            unset h8s_exports
          '';
        };

        packages.tools = pkgs.buildEnv {
          name = "tools";
          paths = tools;
        };

        defaultPackage = self.packages.${system}.tools;
      }
    );
}