{pkgs} @ args:
pkgs.mkShell {
  buildInputs = with pkgs; [
    alejandra
    sops
    openssl
    (pkgs.writeShellScriptBin "homey-deploy-rpi-main" ''
      nixos-rebuild switch \
        --flake .#pi-main \
        --target-host admin@192.168.1.100 \
        --build-host admin@192.168.1.100 \
        --use-remote-sudo
    '')
    (pkgs.writeShellScriptBin "homey-build-rpi-main" ''
      sudo nixos-rebuild switch \
        --flake .#pi-main
    '')
    (pkgs.writeShellScriptBin "homey-offload-backup" ''
      # The script itself is built from modules/backup.nix and installed on
      # the Pi via nixos-rebuild (see homey-deploy-rpi-main) — this just
      # invokes it. Redeploy first if you've changed which services
      # contribute to homey.backup.extraPaths.
      ssh -t admin@192.168.1.100 'sudo homey-offload-backup'
    '')
    (pkgs.writeShellScriptBin "homey-backup-status" ''
      ssh admin@192.168.1.100 bash -s <<'ENDSSH'
        echo "=== Backup timer ==="
        systemctl status restic-backups-homey.timer --no-pager -l 2>&1 || true

        echo ""
        echo "=== Last backup run (journal) ==="
        journalctl -u restic-backups-homey.service -n 50 --no-pager 2>&1 || true

        echo ""
        echo "=== Recent snapshots ==="
        sudo bash -c '
          export AWS_ACCESS_KEY_ID=$(cat /run/secrets/restic/s3_access_key_id)
          export AWS_SECRET_ACCESS_KEY=$(cat /run/secrets/restic/s3_secret_access_key)
          export RESTIC_CACHE_DIR=/mnt/data/restic-cache
          restic \
            -r "s3:https://s3.us-east-005.backblazeb2.com/zakobar-home-backup" \
            --password-file /run/secrets/restic/password \
            snapshots --latest 5
        ' 2>&1
      ENDSSH
    '')
  ];
}