let
  credentials = {
    # REDACTED
  };

  # Shared by all machines
  shared = {
    deployment.targetEnv = "gce";
    deployment.gce = credentials // {
      region = "us-west1-b";
      rootDiskSize = 20; # GiB
    };
  };

  gitlab = {resources, ...}: {
    deployment.targetEnv = "gce";
    deployment.gce = {
      instanceType = "n1-standard-2"; # 2 vCPUs, 7.5GB RAM
      tags = [ "gitlab" ];
      network = resources.gceNetworks.net;
    };

    imports = [
      ./foobar.nix
      ./secrets.nix
    ];

    swapDevices = [ { device = "/var/swapfile"; size = 4096; } ];
  } // shared; # TODO: This doesn't work

  runner = { resources, ...}: {
    deployment.gce = {
      instanceType = "g1-small"; # 1 shared vCPU, 1.7 GB RAM
      tags = [ "gitlab-runner" ];
      network = resources.gceNetworks.net;
    };

    imports = [
      ./barfoo.nix
      ./secrets.nix
    ];

    networking.hostName = "gitlab-runner.slumberso.me";

    swapDevices = [ { device = "/var/swapfile"; size = 4096; } ];
  } // shared; # TODO: This doesn't work

in {

  resources.gceNetworks.net = credentials // {
    addressRange = "192.168.4.0/24";
    firewall = {
      allow-http = {
        targetTags = [ "gitlab" ];
        allowed.tcp = [ 80 ];
      };
      allow-https = {
        targetTags = [ "gitlab" ];
        allowed.tcp = [ 443 ];
      };
      allow-ping.allowed.icmp = null;
    };
  };

  resources.gceTargetPools.gitlab = { resources, nodes, ...}: credentials // {
    region = "us-west1";
    machines = with nodes; [ server ];
  };

  # TODO: Naming the machine "server" is not helpful
  server = gitlab;
}