{
  description = "HomeLab infras — reproducible Ansible control-plane dev shell";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
  };

  outputs = { self, nixpkgs }:
    let
      systems = [ "x86_64-linux" "aarch64-linux" ];
      forAllSystems = f:
        nixpkgs.lib.genAttrs systems (system: f nixpkgs.legacyPackages.${system});
    in
    {
      devShells = forAllSystems (pkgs:
        let
          # One Python environment carrying ansible-core *and* the libraries the
          # modules import in-process (community.proxmox needs proxmoxer +
          # requests). Ansible sets ansible_python_interpreter for the implicit
          # localhost to sys.executable, so `hosts: localhost` and
          # `delegate_to: localhost` tasks pick these up automatically.
          pythonEnv = pkgs.python3.withPackages (ps: with ps; [
            ansible-core
            proxmoxer
            requests
          ]);
        in
        {
          default = pkgs.mkShell {
            name = "homelab-infras";

            packages = [
              pythonEnv
              pkgs.ansible-lint
              pkgs.yamllint
              pkgs.git
              pkgs.jq
              pkgs.openssh
              pkgs.curl
              pkgs.gnumake
            ];

            shellHook = ''
              repo_root="$(${pkgs.git}/bin/git rev-parse --show-toplevel 2>/dev/null || pwd)"
              ansible_dir="$repo_root/ansible"

              if [ -f "$ansible_dir/ansible.cfg" ]; then
                # ansible.cfg spells its paths relative to ansible/, so pin them
                # absolutely here — that makes the shell usable from the repo
                # root as well as from inside ansible/.
                export ANSIBLE_CONFIG="$ansible_dir/ansible.cfg"
                export ANSIBLE_INVENTORY="$ansible_dir/inventory/hosts.yml"
                export ANSIBLE_ROLES_PATH="$ansible_dir/roles"
                export ANSIBLE_COLLECTIONS_PATH="$ansible_dir/collections"
              else
                echo "warn: $ansible_dir/ansible.cfg not found — run commands from ansible/" >&2
              fi

              # Banner goes to stderr so `nix develop --command ...` keeps a
              # clean stdout for scripting.
              {
                _ver_ansible="$(ansible --version 2>/dev/null | head -n1 | tr -d '[]' | awk '{print $3}')"
                _ver_lint="$(NO_COLOR=1 ansible-lint --version 2>/dev/null | tail -n1 | awk '{print $2}')"
                _ver_yaml="$(yamllint --version 2>/dev/null | awk '{print $2}')"
                _ver_py="$(python3 --version 2>&1 | awk '{print $2}')"

                echo "HomeLab infras dev shell"
                echo "  ansible-core  $_ver_ansible"
                echo "  ansible-lint  $_ver_lint"
                echo "  yamllint      $_ver_yaml"
                echo "  python        $_ver_py (proxmoxer, requests)"
                echo ""
                echo "ANSIBLE_CONFIG=$ANSIBLE_CONFIG"
                echo ""
                echo "Galaxy collections are NOT installed automatically. Run once:"
                echo "  ansible-galaxy collection install -r $ansible_dir/requirements.yml -p $ansible_dir/collections"
                echo ""

                unset _ver_ansible _ver_lint _ver_yaml _ver_py
              } >&2
            '';
          };
        });

      formatter = forAllSystems (pkgs: pkgs.nixpkgs-fmt);
    };
}