{ self, inputs, ... }: {

  # Lenovo Chromebook Duet 3 (`lenovo-wormdingler`) on Mobile NixOS.
  # Full V2 stack: mobile-nixos device + Niri/Hyprland/DMS, DankGreeter, wvkbd, IIO sensors,
  # touchscreen calibration + resume-rebind, attic cache, sops, and the standard user catalog.
  # Host-only quirks live in `_private/touch-tablet.nix` and `_private/platform.nix`.
  flake.nixosModules.ideapadConfiguration =
    {
      self,
      config,
      lib,
      pkgs,
      ...
    }:
    {
      imports = [
        # Mobile NixOS device + family + depthcharge system-type.
        (import "${inputs.mobile-nixos}/lib/configuration.nix" {
          device = "lenovo-wormdingler";
        })

        self.nixosModules.ideapadHardware

        inputs.home-manager.nixosModules.home-manager
        inputs.sops-nix.nixosModules.sops

        self.nixosModules.system
        self.nixosModules.desktop
        self.nixosModules.users

        self.nixosModules."client-services"

        # Host-only: IIO + touchscreen calibration + per-compositor tablet/autorotate helpers.
        ./_private/touch-tablet.nix

        # Host-only: cpufreq, lid/power-button policy, upower thresholds.
        ./_private/platform.nix
      ];

      # ─────────────────────── Sops ───────────────────────
      # `host_ideapad` recipient in `.sops.yaml` derives from the new ed25519 host key (post-reflash).
      sops = {
        defaultSopsFile = ../../../secrets/secrets.yaml;
        defaultSopsFormat = "yaml";
        age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
      };

      sops.secrets."users/olivier/hashedPassword".neededForUsers = true;
      sops.secrets."caching/attic/token" = {
        owner = "olivier";
        group = "users";
        mode = "0400";
      };
      sops.secrets."swiftshare/API_KEY" = {
        owner = "olivier";
        group = "users";
        mode = "0400";
      };

      # ─────────────────────── Mobile NixOS / firmware ───────────────────────
      # mruby's test-suite breaks on aarch64 in the Nix sandbox; the overlay strips checks and
      # rebuilds Mobile NixOS' script-loader against the patched mruby.
      chiasson.system.ideapadMrubyOverlay.enable = true;

      # Wi-Fi modem (qcom-wcn3990) + Bluetooth (QCA crnv32) need binary blobs.
      nixpkgs.config.allowUnfreePredicate =
        pkg: builtins.elem (lib.getName pkg) [
          "chromeos-sc7180-unredistributable-firmware"
          "chromeos-sc7180-unredistributable-firmware-zstd"
        ];
      hardware.firmware = [ pkgs.chromeos-sc7180-unredistributable-firmware ];
      hardware.enableRedistributableFirmware = true;

      # ─────────────────────── Attic (substitution + push + CLI token) ───────
      chiasson.system.caching.attic = {
        enable = true;
        cacheName = "nixos-new";
        endpoint = "http://192.168.2.238:8080/";
        publicKey = "nixos-new:8NySIcT0HP7KvGQKgBRWoWESxxRA8BVYo8S85UNpNX0=";
        tokenFile = config.sops.secrets."caching/attic/token".path;
        push.enable = true;
        userCli.enable = true;
      };

      # ─────────────────────── System bits ───────────────────────
      chiasson.system = {
        audio.enable = true;
        networking = {
          hostName = "ideapad";
          networkManager = {
            enable = true;
            unmanaged = [ ];
          };
          wifi.tools.enabled = true;
        };
        extraPackages = with pkgs; [
          gitMinimal
          sops
          ssh-to-age
        ];
      };

      # ─────────────────────── Desktop ───────────────────────
      # Both compositors are enabled — DankGreeter picks at login, V2 default is Niri.
      # Per-session tablet-mode / autorotate daemons live in `_private/touch-tablet.nix`.
      chiasson.desktop = {
        niri.enable = true;
        hyprland.enable = false;

        defaultSession = "niri";
        shell = "dms";
        shells.dms = {
          enableWvkbdToggle = true;
          enableRbwLockToggle = true;
          # Cross-build on the 14900k via binfmt and push back over LAN — much faster than
          # rebuilding aarch64 closure on the Snapdragon. Mirrors the old NixOS-New flow:
          # ssh out to nixdesk, run nixos-rebuild --target-host pointing back at us.
          rebuildCommand = [
            "bash"
            "-lc"
            ''
              ssh -t olivier@nixdesk \
                "nixos-rebuild switch --flake path:/home/olivier/chiasson-nix#ideapad --target-host olivier@ideapad --sudo --ask-sudo-password 2>&1"
            ''
          ];
        };

      };

      chiasson.users.enabled = [ "olivier" ];

      system.stateVersion = "26.05";
    };
}