{
  findutils,
  runCommandLocal,
  rsync,
}:
runCommandLocal "sane-nix-files" {
  nativeBuildInputs = [
    findutils
    rsync
  ];

  meta = {
    description = "top-level host configs for Colin's machines";
    longDescription = ''
      i like to ensure a copy of my config is present on all my machines,
      and this does that in a hermetic way.
    '';
  };
} ''
  mkdir src
  pushd src

  rsync -lptr ${../../../.}/ ./
  chmod u+w .
  for pat in $(cat .gitignore); do
    set +e
    chmod u+w -R "$pat" ; rm -rf "$pat"
    find $PWD -name "$pat" -exec 'chmod u+w -R {}; rm -rf {}' \;
    set -e
  done
  rsync -lptr ./ $out/

  popd
''