{ build-timestamp, networks, pkgs-for }:

hostname:  hostOpts:

{ config, lib, ... }:

with lib;
{
  config = {
    instance = {
      inherit build-timestamp;
    };

    nixpkgs.pkgs = pkgs-for hostOpts.arch;

    deployment = let
      domain = hostOpts.domain;
      host-ip = networks.${domain}.hosts.${hostname}.ipv4-address;
      fs-keys = config.fudo.secrets.files.host-filesystem-keys;
      keys = if (hasAttr hostname fs-keys) then
        mapAttrs (secret: secret-file: {
          keyFile = secret-file;
          user = "root";
          permissions = "0400";
        }) fs-keys.${hostname} else {};
    in {
      inherit keys;
      targetHost = host-ip;
    };
  };
}