nodes = {
    "inazuma": {
        "os": "alpine",
        # this requires that the ssh user has `permit nopass :wheel/user`
        "cmd_wrapper_outer": "doas -n sh -c {}",
        "metadata": {
            # HACK: this is needed to route host services from containerized traefik
            "container_gateway": "10.89.0.1",
            "ssh": {
                "port": "23022",
            },
            "tailscale": {
                "authkey": "dummy",
            },
            "www": {
                "doyouhavewifi": {
                    "port": "20100",
                },
                "gzr-im-preview": {
                    "port": "20101",
                },
                "gzr-im": {
                    "port": "20102",
                },
                "lhost": {
                    "port": "20103",
                },
                "quad9-demo": {
                    "port": "20104",
                },
                "gonca-me": {
                    "port": "20107",
                },
            },
            "glance": {
                "port": "20106",
            },
            "go-away": { 'port': "20199" },
            "go-away-metrics": { 'port': "20198" },
        },
        "bundles": {
            "firewall",
            "fail2ban",
            "glance",
            ## containers ##
            "authelia",
            "golink",
            "miniflux",
            "prometheus",
            "vaultwarden",
            # "langtool",
            "go-away",
            "cal",
            ## www ##
            "doyouhavewifi",
            "gzr-im-preview",
            "gzr-im",
            "lhost",
            "quad9-demo",
            "gonca-me",
        },
    },
    "shimakaze": {
        "os": "alpine",
        "cmd_wrapper_outer": "doas -n sh -c {}",
        "metadata": {
            # HACK: this is needed to route host services from containerized traefik
            "container_gateway": "10.89.0.1",
            "ssh": {
                "port": "22",
            },
            "tailscale": {
                "authkey": "dummy",
            }
        },
        "bundles": {
            "hdidle",
            "paperless",
            "jellyfin",
            "immich",
            "nfs",
        },
    },

    "vast": {
        "os": "debian",
        "bundles": {
            "apt",
            "vast-base",
        }
    },

    # "kiso": {
    #     "os": "macos",
    #     "bundles": {
    #         "brew",
    #         "macos-base",
    #     }
    # }
}