{
  inputs = {
    nixpkgs.url = "github:nixos/nixpkgs/nixos-24.05";
    nixpkgs-unstable.url = "github:nixos/nixpkgs/nixos-unstable";

    get-flake.url = "github:ursi/get-flake";

    home-manager.url = "github:nix-community/home-manager/release-24.05";
    home-manager.inputs.nixpkgs.follows = "nixpkgs";

    disko.url = "github:nix-community/disko";
    disko.inputs.nixpkgs.follows = "nixpkgs";
    srvos.url = "github:numtide/srvos";
    srvos.inputs.nixpkgs.follows = "nixpkgs";

    nixos-sbc.url =
      "github:nakato/nixos-sbc"
      # "github:steveej-forks/nakato_nixos-sbc/kernel-6.9_and_cross-compile"
      ;
    nixos-sbc.inputs.nixpkgs.follows = "nixpkgs";

    nixos-nftables-firewall.url = "github:thelegy/nixos-nftables-firewall";
    nixos-nftables-firewall.inputs.nixpkgs.follows = "nixpkgs";

    hostapd.url = "git://w1.fi/hostap.git?branch=main";
    hostapd.flake = false;

    openwrt.url = "git+https://github.com/openwrt/openwrt.git?ref=main&rev=847984c773d819d5579d5abae4b80a4983103ed9";
    openwrt.flake = false;

    # TODO: would be nice if this worked but it throws an error when using the input as a patch:
    # error: flake input has unsupported input type 'file'
    # hostapd_patch_vlan_no_bridge = {
    #   url = "file+https://raw.githubusercontent.com/openwrt/openwrt/847984c773d819d5579d5abae4b80a4983103ed9/package/network/services/hostapd/patches/710-vlan_no_bridge.patch";
    #   flake = false;
    # };
  };

  outputs = {
    self,
    get-flake,
    nixpkgs,
    nixos-sbc,
    ...
  }: let
    nativeSystem = "aarch64-linux";
    nodeName = "router0-dmz0";

    pkgs = nixpkgs.legacyPackages.${nativeSystem};
    pkgsCross = import self.inputs.nixpkgs {
      system = "x86_64-linux";
      crossSystem = {
        config = "aarch64-unknown-linux-gnu";
      };
    };

    mkNixosConfiguration = {extraModules ? [], ...} @ attrs:
      nixpkgs.lib.nixosSystem (
        nixpkgs.lib.attrsets.recursiveUpdate
        attrs
        {
          specialArgs =
            (import ./default.nix {
              system = nativeSystem;
              inherit nodeName;

              repoFlake = get-flake ../../../..;
              nodeFlake = self;
            })
            .meta
            .nodeSpecialArgs
            .${nodeName};

          modules =
            [
              ./configuration.nix

              # flake registry
              {
                nixpkgs.overlays = builtins.attrValues self.overlays;
                nix.registry.nixpkgs.flake = nixpkgs;
              }
            ]
            ++ extraModules;
        }
      );
  in {
    nixosConfigurations = {
      native = mkNixosConfiguration {
        system = nativeSystem;
      };

      cross = mkNixosConfiguration {
        extraModules = [
          {
            nixpkgs.buildPlatform.system = "x86_64-linux";
            nixpkgs.hostPlatform.system = nativeSystem;
          }
        ];
      };
    };

    overlays.default = final: previous: {
      hostapd = previous.hostapd.overrideDerivation (attrs: {
        patches =
          attrs.patches
          ++ [
            "${self.inputs.openwrt}/package/network/services/hostapd/patches/710-vlan_no_bridge.patch"
          ];
      });
    };
  };
}