{
  perSystem =
    { lib, pkgs, ... }:
    {
      apps.infra-deploy =
        let
          hosts = builtins.attrNames (
            lib.attrsets.filterAttrs (_: type: type == "directory") (builtins.readDir ./hosts)
          );

          bin = pkgs.writeShellApplication {
            name = "deploy";
            runtimeInputs = [
              # keep-sorted start
              pkgs.fzf
              pkgs.git
              pkgs.inetutils
              pkgs.nixos-rebuild
              # keep-sorted end
            ];
            text = ''
              selected=("$@")

              if [ "''${#selected[@]}" -eq 0 ]; then
                readarray -t selected < <(printf '%s\n' ${lib.escapeShellArgs hosts} | fzf --multi)
              fi

              if [ "''${#selected[@]}" -eq 0 ]; then
                echo "error: no host selected" >&2
                exit 1
              fi

              if [ "''${#selected[@]}" -eq 1 ] && [ "''${selected[0]}" = "all" ]; then
                selected=(${lib.escapeShellArgs hosts})
              fi

              rootdir="$(git rev-parse --show-toplevel)"

              for host in "''${selected[@]}"; do
                target=()
                if [ "$host" != "$(hostname)" ]; then
                  target=(--target-host "deploy@$host")
                fi

                echo "info: deploying $host"
                nixos-rebuild switch \
                  --no-reexec \
                  --use-substitutes \
                  --sudo \
                  --flake "$rootdir#$host" \
                  "''${target[@]}"
              done
            '';
          };
        in
        {
          type = "app";
          program = "${bin}/bin/deploy";
          meta.description = "deploy the nixos configurations to the given hosts";
        };
    };
}