From 86ec67c8f4fd22183c876abdc9013f47b0f46c9a Mon Sep 17 00:00:00 2001
From: Andrei Dziahel <develop7@develop7.info>
Date: Wed, 22 Apr 2026 15:41:24 +0200
Subject: [PATCH] feat: migrate generator to Nickel

---
 .github/actions/build-generator/action.yaml   |  14 ---
 .github/workflows/gen-pop-cache.yaml          |  11 --
 .github/workflows/generator.yml               |  49 ++++----
 .gitignore                                    |   2 -
 9.10/_cabal-install.deb11.yaml                |   3 -
 9.10/_cabal-install.deb12.yaml                |   3 -
 9.10/_globals.ncl                             |  14 +++
 9.10/_globals.yaml                            |   9 --
 9.10/bookworm.ncl                             |  27 +++++
 9.10/bookworm.yaml                            |  21 ----
 9.10/bullseye.ncl                             |  24 ++++
 9.10/bullseye.yaml                            |  17 ---
 9.10/slim-bookworm.ncl                        |  27 +++++
 9.10/slim-bookworm.yaml                       |  21 ----
 9.10/slim-bullseye.ncl                        |  24 ++++
 9.10/slim-bullseye.yaml                       |  17 ---
 9.12/_globals.ncl                             |  14 +++
 9.12/_globals.yaml                            |   9 --
 9.12/bookworm.ncl                             |  24 ++++
 9.12/bookworm.yaml                            |  16 ---
 9.12/bookworm/Dockerfile                      |   2 +-
 9.12/bullseye.ncl                             |  27 +++++
 9.12/bullseye.yaml                            |  21 ----
 9.12/slim-bookworm.ncl                        |  24 ++++
 9.12/slim-bookworm.yaml                       |  16 ---
 9.12/slim-bullseye.ncl                        |  27 +++++
 9.12/slim-bullseye.yaml                       |  21 ----
 9.14/_globals.ncl                             |  14 +++
 9.14/_globals.yaml                            |   9 --
 9.14/bookworm.ncl                             |  24 ++++
 9.14/bookworm.yaml                            |  16 ---
 9.14/bullseye.ncl                             |  27 +++++
 9.14/bullseye.yaml                            |  22 ----
 9.14/slim-bookworm.ncl                        |  24 ++++
 9.14/slim-bookworm.yaml                       |  16 ---
 9.14/slim-bullseye.ncl                        |  27 +++++
 9.14/slim-bullseye.yaml                       |  22 ----
 9.4/_cabal-install.ncl                        |   6 +
 9.4/_cabal-install.yaml                       |   3 -
 9.4/_ghc.ncl                                  |  11 ++
 9.4/_ghc.yaml                                 |   5 -
 9.4/_globals.ncl                              |  14 +++
 9.4/_globals.yaml                             |   9 --
 9.4/bullseye.ncl                              |  12 ++
 9.4/bullseye.yaml                             |  13 --
 9.4/slim-bullseye.ncl                         |  12 ++
 9.4/slim-bullseye.yaml                        |  13 --
 9.6/_cabal-install.ncl                        |   6 +
 9.6/_cabal-install.yaml                       |   3 -
 9.6/_ghc.ncl                                  |  11 ++
 9.6/_ghc.yaml                                 |   5 -
 9.6/_globals.ncl                              |  14 +++
 9.6/_globals.yaml                             |   9 --
 9.6/bullseye.ncl                              |  12 ++
 9.6/bullseye.yaml                             |  13 --
 9.6/slim-bullseye.ncl                         |  12 ++
 9.6/slim-bullseye.yaml                        |  13 --
 9.8/_cabal-install.ncl                        |   6 +
 9.8/_cabal-install.yaml                       |   3 -
 9.8/_ghc.ncl                                  |   8 ++
 9.8/_ghc.yaml                                 |   5 -
 9.8/_globals.ncl                              |  14 +++
 9.8/_globals.yaml                             |   9 --
 9.8/bullseye.ncl                              |  12 ++
 9.8/bullseye.yaml                             |   9 --
 9.8/slim-bullseye.ncl                         |  12 ++
 9.8/slim-bullseye.yaml                        |   9 --
 README.md                                     |  36 +++---
 generate.sh                                   |  45 +++++--
 generator/.gitignore                          |   3 -
 generator/CHANGELOG.md                        |   5 -
 generator/app/Main.hs                         | 113 ------------------
 generator/app/Options.hs                      |  69 -----------
 generator/generator.cabal                     |  84 -------------
 generator/hie.yaml                            |   2 -
 generator/stack.yaml                          |  68 -----------
 generator/stack.yaml.lock                     |  12 --
 template/{Dockerfile.jinja => Dockerfile.ncl} |  51 +++++---
 template/schema.ncl                           |  93 ++++++++++++++
 79 files changed, 705 insertions(+), 844 deletions(-)
 delete mode 100644 .github/actions/build-generator/action.yaml
 delete mode 100644 .github/workflows/gen-pop-cache.yaml
 delete mode 100644 9.10/_cabal-install.deb11.yaml
 delete mode 100644 9.10/_cabal-install.deb12.yaml
 create mode 100644 9.10/_globals.ncl
 delete mode 100644 9.10/_globals.yaml
 create mode 100644 9.10/bookworm.ncl
 delete mode 100644 9.10/bookworm.yaml
 create mode 100644 9.10/bullseye.ncl
 delete mode 100644 9.10/bullseye.yaml
 create mode 100644 9.10/slim-bookworm.ncl
 delete mode 100644 9.10/slim-bookworm.yaml
 create mode 100644 9.10/slim-bullseye.ncl
 delete mode 100644 9.10/slim-bullseye.yaml
 create mode 100644 9.12/_globals.ncl
 delete mode 100644 9.12/_globals.yaml
 create mode 100644 9.12/bookworm.ncl
 delete mode 100644 9.12/bookworm.yaml
 create mode 100644 9.12/bullseye.ncl
 delete mode 100644 9.12/bullseye.yaml
 create mode 100644 9.12/slim-bookworm.ncl
 delete mode 100644 9.12/slim-bookworm.yaml
 create mode 100644 9.12/slim-bullseye.ncl
 delete mode 100644 9.12/slim-bullseye.yaml
 create mode 100644 9.14/_globals.ncl
 delete mode 100644 9.14/_globals.yaml
 create mode 100644 9.14/bookworm.ncl
 delete mode 100644 9.14/bookworm.yaml
 create mode 100644 9.14/bullseye.ncl
 delete mode 100644 9.14/bullseye.yaml
 create mode 100644 9.14/slim-bookworm.ncl
 delete mode 100644 9.14/slim-bookworm.yaml
 create mode 100644 9.14/slim-bullseye.ncl
 delete mode 100644 9.14/slim-bullseye.yaml
 create mode 100644 9.4/_cabal-install.ncl
 delete mode 100644 9.4/_cabal-install.yaml
 create mode 100644 9.4/_ghc.ncl
 delete mode 100644 9.4/_ghc.yaml
 create mode 100644 9.4/_globals.ncl
 delete mode 100644 9.4/_globals.yaml
 create mode 100644 9.4/bullseye.ncl
 delete mode 100644 9.4/bullseye.yaml
 create mode 100644 9.4/slim-bullseye.ncl
 delete mode 100644 9.4/slim-bullseye.yaml
 create mode 100644 9.6/_cabal-install.ncl
 delete mode 100644 9.6/_cabal-install.yaml
 create mode 100644 9.6/_ghc.ncl
 delete mode 100644 9.6/_ghc.yaml
 create mode 100644 9.6/_globals.ncl
 delete mode 100644 9.6/_globals.yaml
 create mode 100644 9.6/bullseye.ncl
 delete mode 100644 9.6/bullseye.yaml
 create mode 100644 9.6/slim-bullseye.ncl
 delete mode 100644 9.6/slim-bullseye.yaml
 create mode 100644 9.8/_cabal-install.ncl
 delete mode 100644 9.8/_cabal-install.yaml
 create mode 100644 9.8/_ghc.ncl
 delete mode 100644 9.8/_ghc.yaml
 create mode 100644 9.8/_globals.ncl
 delete mode 100644 9.8/_globals.yaml
 create mode 100644 9.8/bullseye.ncl
 delete mode 100644 9.8/bullseye.yaml
 create mode 100644 9.8/slim-bullseye.ncl
 delete mode 100644 9.8/slim-bullseye.yaml
 delete mode 100644 generator/.gitignore
 delete mode 100644 generator/CHANGELOG.md
 delete mode 100644 generator/app/Main.hs
 delete mode 100644 generator/app/Options.hs
 delete mode 100644 generator/generator.cabal
 delete mode 100644 generator/hie.yaml
 delete mode 100644 generator/stack.yaml
 delete mode 100644 generator/stack.yaml.lock
 rename template/{Dockerfile.jinja => Dockerfile.ncl} (78%)
 create mode 100644 template/schema.ncl

diff --git a/.github/actions/build-generator/action.yaml b/.github/actions/build-generator/action.yaml
deleted file mode 100644
index d50f402b..00000000
--- a/.github/actions/build-generator/action.yaml
+++ /dev/null
@@ -1,14 +0,0 @@
-name: "Build generator"
-description: "Build the generator binary caching build artifacts and dependencies."
-inputs:
-  debug_mode:
-    description: "Enable debug mode for the generator build process."
-    required: false
-    default: false
-runs:
-  using: "composite"
-  steps:
-    - uses: freckle/stack-action@v5
-      with:
-        working-directory: "./generator/"
-        stack-build-arguments: "${{ github.ref_name != 'main' && '--fast' || '' }} --pedantic"
diff --git a/.github/workflows/gen-pop-cache.yaml b/.github/workflows/gen-pop-cache.yaml
deleted file mode 100644
index f7cf0931..00000000
--- a/.github/workflows/gen-pop-cache.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-name: "Populate cache for generator"
-on:
-  workflow_dispatch: {}
-  schedule:
-    - cron: '0 0 * * 0,4' # Make sure to run at least once a week to avoid eviction
-jobs:
-  populate-cache:
-    runs-on: ubuntu-22.04
-    steps:
-      - uses: actions/checkout@v5.0.0
-      - uses: ./.github/actions/build-generator
diff --git a/.github/workflows/generator.yml b/.github/workflows/generator.yml
index 92c5e90e..2dacb3b9 100644
--- a/.github/workflows/generator.yml
+++ b/.github/workflows/generator.yml
@@ -1,39 +1,30 @@
-name: Dockerfile Generator
+name: Dockerfile Validator
 on:
   push:
     paths:
-      - generator
+      - '**/*.ncl'
+      - 'template/Dockerfile.ncl'
+      - 'generate.sh'
+      - '.github/workflows/generator.yml'
   workflow_dispatch:
-    inputs:
-      debug_mode:
-        description: 'Enable debug mode'
-        type: boolean
-        default: false
-        required: false
 
 jobs:
-  build:
+  generate:
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v5.0.0
-      - uses: ./.github/actions/build-generator
-#        with:
-#          debug_mode: ${{ github.event.inputs.debug_mode }}
-      - name: Run generator
-        working-directory: generator
-        run: stack exec generator -- --help
+      - uses: actions/checkout@v6.0.2
+      - name: Install Nickel
+        uses: cachix/install-nix-action@v31.10.5
 
-      - name: Copy generator binary to artifacts
-        working-directory: generator
+      - name: Install nickel binary
+        run: nix profile install nixpkgs#nickel
+
+      - name: Generate Dockerfiles
         run: |
-          mkdir -p ../artifacts
-          stack --local-bin-path=../artifacts install
-      - name: Upload generated artifact to a release
-        uses: softprops/action-gh-release@v2.4.1
-        with:
-          name: Generator
-          tag_name: generator-binary
-          prerelease: true
-          overwrite_files: 'true'
-          files: |
-            artifacts/generator
+          for f in $(find . -name '*.ncl' -not -name '_*'); do
+            echo "Generating Dockerfile for $basename"
+            ./generate.sh $f "$(basename $f .ncl)/Dockerfile"
+          done
+
+      - name: Verify no diff after generation
+        run: git diff --exit-code
diff --git a/.gitignore b/.gitignore
index ea95de4d..e856892a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,5 +1,3 @@
-generator/.stack-work
-generator/dist-newstyle
 /.idea
 
 keys/*
diff --git a/9.10/_cabal-install.deb11.yaml b/9.10/_cabal-install.deb11.yaml
deleted file mode 100644
index ca8620e1..00000000
--- a/9.10/_cabal-install.deb11.yaml
+++ /dev/null
@@ -1,3 +0,0 @@
-sha256sum:
-  "aarch64": '5e8c47a055d5b744741039a7061ee43ec7d080d1251784e7a4cd836403e42523'
-  "x86_64": '41b85bb25fa654e4b79169014b9142fe696ff35e002e043caa0e52d65204ba8a'
diff --git a/9.10/_cabal-install.deb12.yaml b/9.10/_cabal-install.deb12.yaml
deleted file mode 100644
index 23bbd2f4..00000000
--- a/9.10/_cabal-install.deb12.yaml
+++ /dev/null
@@ -1,3 +0,0 @@
-sha256sum:
-  "aarch64": 'f763fb2af2bc1ff174b7361a7d51109a585954f87a0e14f86d144f3bce28f7a9'
-  "x86_64": '73a463306c771e18ca22c0a9469176ffab0138ec5925adb5364ef47174e1adc5'
diff --git a/9.10/_globals.ncl b/9.10/_globals.ncl
new file mode 100644
index 00000000..f1947ff7
--- /dev/null
+++ b/9.10/_globals.ncl
@@ -0,0 +1,14 @@
+{
+  stack = {
+    version = "3.3.1",
+    release_key = "C5705533DA4F78D8664B5DC0575159689BEFB442",
+    assets = {
+      aarch64 = { sha256sum = "bdd618ea5a9c921417727011f2ecd78987dffa5cee5e741108baf65a9b5b58ab" },
+      x86_64 = { sha256sum = "88d7e517342c125b0a098d9d578fe53e590618ae4b2427283a27408a1ebd06d8" },
+    },
+  },
+  cabal_install = {
+    version = "3.14.1.1",
+    release_key = "EAF2A9A722C0C96F2B431CA511AAD8CEDEE0CAEF",
+  },
+}
diff --git a/9.10/_globals.yaml b/9.10/_globals.yaml
deleted file mode 100644
index a6d67e60..00000000
--- a/9.10/_globals.yaml
+++ /dev/null
@@ -1,9 +0,0 @@
-stack:
-  version: "3.3.1"
-  release_key: "C5705533DA4F78D8664B5DC0575159689BEFB442"
-  sha256sum:
-    "aarch64": 'bdd618ea5a9c921417727011f2ecd78987dffa5cee5e741108baf65a9b5b58ab'
-    "x86_64": '88d7e517342c125b0a098d9d578fe53e590618ae4b2427283a27408a1ebd06d8'
-cabal_install:
-  version: "3.14.1.1"
-  release_key: "EAF2A9A722C0C96F2B431CA511AAD8CEDEE0CAEF"
diff --git a/9.10/bookworm.ncl b/9.10/bookworm.ncl
new file mode 100644
index 00000000..95a18ecc
--- /dev/null
+++ b/9.10/bookworm.ncl
@@ -0,0 +1,27 @@
+let globals = import "_globals.ncl"
+in
+globals
+& {
+  distro = {
+    codename = "bookworm",
+    abbr = "deb12",
+    image = "debian:bookworm",
+  },
+  ghc = {
+    version = "9.10.3",
+    release_key = "88B57FCF7DB53B4DB3BFA4B1588764FBE22D19C4",
+    assets = {
+      aarch64 = {
+        sha256sum = "052789dfe7f6fba6dc3822de0da272e8a5bd358c37adae17d8e82cff39bc1008",
+        url = "https://downloads.haskell.org/~ghc/9.10.3/ghc-9.10.3-aarch64-deb11-linux.tar.xz",
+      },
+      x86_64 = { sha256sum = "1ac63f04eac0ad551d45cbde38f27e0e3f43ceefd98833fae1fa3f2dbd042367" },
+    },
+  },
+  cabal_install = {
+    assets = {
+      aarch64 = { sha256sum = "f763fb2af2bc1ff174b7361a7d51109a585954f87a0e14f86d144f3bce28f7a9" },
+      x86_64 = { sha256sum = "73a463306c771e18ca22c0a9469176ffab0138ec5925adb5364ef47174e1adc5" },
+    },
+  },
+}
diff --git a/9.10/bookworm.yaml b/9.10/bookworm.yaml
deleted file mode 100644
index 7b7bbb47..00000000
--- a/9.10/bookworm.yaml
+++ /dev/null
@@ -1,21 +0,0 @@
----
-distro:
-  codename: 'bookworm'
-  abbr: 'deb12'
-  image: 'debian:bookworm'
-ghc:
-  version: "9.10.3"
-  release_key: "88B57FCF7DB53B4DB3BFA4B1588764FBE22D19C4"
-  sha256sum:
-    "aarch64": '052789dfe7f6fba6dc3822de0da272e8a5bd358c37adae17d8e82cff39bc1008'
-    "x86_64": '1ac63f04eac0ad551d45cbde38f27e0e3f43ceefd98833fae1fa3f2dbd042367'
-cabal_install:
-  sha256sum:
-    "aarch64": 'f763fb2af2bc1ff174b7361a7d51109a585954f87a0e14f86d144f3bce28f7a9'
-    "x86_64": '73a463306c771e18ca22c0a9469176ffab0138ec5925adb5364ef47174e1adc5'
-overrides:
-  ghc:
-    "aarch64":
-      # GHC 9.10.3 doesn't have a deb12 bindist for aarch64 for some reason, so we're using the bullseye one instead
-      url: "https://downloads.haskell.org/~ghc/9.10.3/ghc-9.10.3-aarch64-deb11-linux.tar.xz"
-_globals: !include '_globals.yaml'
diff --git a/9.10/bullseye.ncl b/9.10/bullseye.ncl
new file mode 100644
index 00000000..de155449
--- /dev/null
+++ b/9.10/bullseye.ncl
@@ -0,0 +1,24 @@
+let globals = import "_globals.ncl"
+in
+globals
+& {
+  distro = {
+    codename = "bullseye",
+    abbr = "deb11",
+    image = "debian:bullseye",
+  },
+  ghc = {
+    version = "9.10.3",
+    release_key = "88B57FCF7DB53B4DB3BFA4B1588764FBE22D19C4",
+    assets = {
+      aarch64 = { sha256sum = "052789dfe7f6fba6dc3822de0da272e8a5bd358c37adae17d8e82cff39bc1008" },
+      x86_64 = { sha256sum = "b6bbd3514e0cdb9db350812a003bb7c670c58d99779086fbe41092b019548924" },
+    },
+  },
+  cabal_install = {
+    assets = {
+      aarch64 = { sha256sum = "5e8c47a055d5b744741039a7061ee43ec7d080d1251784e7a4cd836403e42523" },
+      x86_64 = { sha256sum = "41b85bb25fa654e4b79169014b9142fe696ff35e002e043caa0e52d65204ba8a" },
+    },
+  },
+}
diff --git a/9.10/bullseye.yaml b/9.10/bullseye.yaml
deleted file mode 100644
index 7a1392ff..00000000
--- a/9.10/bullseye.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
----
-distro:
-  codename: 'bullseye'
-  abbr: 'deb11'
-  image: 'debian:bullseye'
-ghc:
-  version: "9.10.3"
-  release_key: "88B57FCF7DB53B4DB3BFA4B1588764FBE22D19C4"
-  sha256sum:
-    "aarch64": '052789dfe7f6fba6dc3822de0da272e8a5bd358c37adae17d8e82cff39bc1008'
-    "x86_64": 'b6bbd3514e0cdb9db350812a003bb7c670c58d99779086fbe41092b019548924'
-cabal_install:
-  sha256sum:
-    "aarch64": '5e8c47a055d5b744741039a7061ee43ec7d080d1251784e7a4cd836403e42523'
-    "x86_64": '41b85bb25fa654e4b79169014b9142fe696ff35e002e043caa0e52d65204ba8a'
-_globals: !include '_globals.yaml'
-
diff --git a/9.10/slim-bookworm.ncl b/9.10/slim-bookworm.ncl
new file mode 100644
index 00000000..df7510c0
--- /dev/null
+++ b/9.10/slim-bookworm.ncl
@@ -0,0 +1,27 @@
+let globals = import "_globals.ncl"
+in
+globals
+& {
+  distro = {
+    codename = "bookworm",
+    abbr = "deb12",
+    image = "debian:bookworm-slim",
+  },
+  ghc = {
+    version = "9.10.3",
+    release_key = "88B57FCF7DB53B4DB3BFA4B1588764FBE22D19C4",
+    assets = {
+      aarch64 = {
+        sha256sum = "052789dfe7f6fba6dc3822de0da272e8a5bd358c37adae17d8e82cff39bc1008",
+        url = "https://downloads.haskell.org/~ghc/9.10.3/ghc-9.10.3-aarch64-deb11-linux.tar.xz",
+      },
+      x86_64 = { sha256sum = "1ac63f04eac0ad551d45cbde38f27e0e3f43ceefd98833fae1fa3f2dbd042367" },
+    },
+  },
+  cabal_install = {
+    assets = {
+      aarch64 = { sha256sum = "f763fb2af2bc1ff174b7361a7d51109a585954f87a0e14f86d144f3bce28f7a9" },
+      x86_64 = { sha256sum = "73a463306c771e18ca22c0a9469176ffab0138ec5925adb5364ef47174e1adc5" },
+    },
+  },
+}
diff --git a/9.10/slim-bookworm.yaml b/9.10/slim-bookworm.yaml
deleted file mode 100644
index 20fc0bba..00000000
--- a/9.10/slim-bookworm.yaml
+++ /dev/null
@@ -1,21 +0,0 @@
----
-distro:
-  codename: 'bookworm'
-  abbr: 'deb12'
-  image: 'debian:bookworm-slim'
-ghc:
-  version: "9.10.3"
-  release_key: "88B57FCF7DB53B4DB3BFA4B1588764FBE22D19C4"
-  sha256sum:
-    "aarch64": '052789dfe7f6fba6dc3822de0da272e8a5bd358c37adae17d8e82cff39bc1008'
-    "x86_64": '1ac63f04eac0ad551d45cbde38f27e0e3f43ceefd98833fae1fa3f2dbd042367'
-cabal_install:
-  sha256sum:
-    "aarch64": 'f763fb2af2bc1ff174b7361a7d51109a585954f87a0e14f86d144f3bce28f7a9'
-    "x86_64": '73a463306c771e18ca22c0a9469176ffab0138ec5925adb5364ef47174e1adc5'
-overrides:
-  ghc:
-    "aarch64":
-      # GHC 9.10.3 doesn't have a deb12 bindist for aarch64 for some reason, so we're using the bullseye one instead
-      url: "https://downloads.haskell.org/~ghc/9.10.3/ghc-9.10.3-aarch64-deb11-linux.tar.xz"
-_globals: !include '_globals.yaml'
diff --git a/9.10/slim-bullseye.ncl b/9.10/slim-bullseye.ncl
new file mode 100644
index 00000000..11a1100c
--- /dev/null
+++ b/9.10/slim-bullseye.ncl
@@ -0,0 +1,24 @@
+let globals = import "_globals.ncl"
+in
+globals
+& {
+  distro = {
+    codename = "bullseye",
+    abbr = "deb11",
+    image = "debian:bullseye-slim",
+  },
+  ghc = {
+    version = "9.10.3",
+    release_key = "88B57FCF7DB53B4DB3BFA4B1588764FBE22D19C4",
+    assets = {
+      aarch64 = { sha256sum = "052789dfe7f6fba6dc3822de0da272e8a5bd358c37adae17d8e82cff39bc1008" },
+      x86_64 = { sha256sum = "b6bbd3514e0cdb9db350812a003bb7c670c58d99779086fbe41092b019548924" },
+    },
+  },
+  cabal_install = {
+    assets = {
+      aarch64 = { sha256sum = "5e8c47a055d5b744741039a7061ee43ec7d080d1251784e7a4cd836403e42523" },
+      x86_64 = { sha256sum = "41b85bb25fa654e4b79169014b9142fe696ff35e002e043caa0e52d65204ba8a" },
+    },
+  },
+}
diff --git a/9.10/slim-bullseye.yaml b/9.10/slim-bullseye.yaml
deleted file mode 100644
index a52438be..00000000
--- a/9.10/slim-bullseye.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
----
-distro:
-  codename: 'bullseye'
-  abbr: 'deb11'
-  image: 'debian:bullseye-slim'
-ghc:
-  version: "9.10.3"
-  release_key: "88B57FCF7DB53B4DB3BFA4B1588764FBE22D19C4"
-  sha256sum:
-    "aarch64": '052789dfe7f6fba6dc3822de0da272e8a5bd358c37adae17d8e82cff39bc1008'
-    "x86_64": 'b6bbd3514e0cdb9db350812a003bb7c670c58d99779086fbe41092b019548924'
-cabal_install:
-  sha256sum:
-    "aarch64": '5e8c47a055d5b744741039a7061ee43ec7d080d1251784e7a4cd836403e42523'
-    "x86_64": '41b85bb25fa654e4b79169014b9142fe696ff35e002e043caa0e52d65204ba8a'
-_globals: !include '_globals.yaml'
-
diff --git a/9.12/_globals.ncl b/9.12/_globals.ncl
new file mode 100644
index 00000000..f1947ff7
--- /dev/null
+++ b/9.12/_globals.ncl
@@ -0,0 +1,14 @@
+{
+  stack = {
+    version = "3.3.1",
+    release_key = "C5705533DA4F78D8664B5DC0575159689BEFB442",
+    assets = {
+      aarch64 = { sha256sum = "bdd618ea5a9c921417727011f2ecd78987dffa5cee5e741108baf65a9b5b58ab" },
+      x86_64 = { sha256sum = "88d7e517342c125b0a098d9d578fe53e590618ae4b2427283a27408a1ebd06d8" },
+    },
+  },
+  cabal_install = {
+    version = "3.14.1.1",
+    release_key = "EAF2A9A722C0C96F2B431CA511AAD8CEDEE0CAEF",
+  },
+}
diff --git a/9.12/_globals.yaml b/9.12/_globals.yaml
deleted file mode 100644
index a6d67e60..00000000
--- a/9.12/_globals.yaml
+++ /dev/null
@@ -1,9 +0,0 @@
-stack:
-  version: "3.3.1"
-  release_key: "C5705533DA4F78D8664B5DC0575159689BEFB442"
-  sha256sum:
-    "aarch64": 'bdd618ea5a9c921417727011f2ecd78987dffa5cee5e741108baf65a9b5b58ab'
-    "x86_64": '88d7e517342c125b0a098d9d578fe53e590618ae4b2427283a27408a1ebd06d8'
-cabal_install:
-  version: "3.14.1.1"
-  release_key: "EAF2A9A722C0C96F2B431CA511AAD8CEDEE0CAEF"
diff --git a/9.12/bookworm.ncl b/9.12/bookworm.ncl
new file mode 100644
index 00000000..862880e4
--- /dev/null
+++ b/9.12/bookworm.ncl
@@ -0,0 +1,24 @@
+let globals = import "_globals.ncl"
+in
+globals
+& {
+  distro = {
+    codename = "bookworm",
+    abbr = "deb12",
+    image = "debian:bookworm",
+  },
+  ghc = {
+    version = "9.12.4",
+    release_key = "88B57FCF7DB53B4DB3BFA4B1588764FBE22D19C4",
+    assets = {
+      aarch64 = { sha256sum = "8d093562f4d54b69fc57f94c021138d8595554407bc2828962cf6bdd394a6c97" },
+      x86_64 = { sha256sum = "cdc60a66f1c89604975c896b3c7577b079b602d8fb093af0f4b2b0912fa47bd1" },
+    },
+  },
+  cabal_install = {
+    assets = {
+      aarch64 = { sha256sum = "f763fb2af2bc1ff174b7361a7d51109a585954f87a0e14f86d144f3bce28f7a9" },
+      x86_64 = { sha256sum = "73a463306c771e18ca22c0a9469176ffab0138ec5925adb5364ef47174e1adc5" },
+    },
+  },
+}
diff --git a/9.12/bookworm.yaml b/9.12/bookworm.yaml
deleted file mode 100644
index fa231bf9..00000000
--- a/9.12/bookworm.yaml
+++ /dev/null
@@ -1,16 +0,0 @@
----
-distro:
-  codename: 'bookworm'
-  abbr: 'deb12'
-  image: 'debian:bookworm'
-ghc:
-  version: "9.12.4"
-  release_key: "88B57FCF7DB53B4DB3BFA4B1588764FBE22D19C4"
-  sha256sum:
-    "aarch64": '8d093562f4d54b69fc57f94c021138d8595554407bc2828962cf6bdd394a6c97'
-    "x86_64": 'cdc60a66f1c89604975c896b3c7577b079b602d8fb093af0f4b2b0912fa47bd1'
-cabal_install:
-  sha256sum:
-    "aarch64": 'f763fb2af2bc1ff174b7361a7d51109a585954f87a0e14f86d144f3bce28f7a9'
-    "x86_64": '73a463306c771e18ca22c0a9469176ffab0138ec5925adb5364ef47174e1adc5'
-_globals: !include '_globals.yaml'
diff --git a/9.12/bookworm/Dockerfile b/9.12/bookworm/Dockerfile
index 7f45c582..cded4497 100644
--- a/9.12/bookworm/Dockerfile
+++ b/9.12/bookworm/Dockerfile
@@ -133,4 +133,4 @@ RUN set -eux; \
 
 ENV PATH=/root/.cabal/bin:/root/.local/bin:/opt/ghc/${GHC}/bin:$PATH
 
-CMD ["ghci"]
+CMD ["ghci"]
\ No newline at end of file
diff --git a/9.12/bullseye.ncl b/9.12/bullseye.ncl
new file mode 100644
index 00000000..86cd24de
--- /dev/null
+++ b/9.12/bullseye.ncl
@@ -0,0 +1,27 @@
+let globals = import "_globals.ncl"
+in
+globals
+& {
+  distro = {
+    codename = "bullseye",
+    abbr = "deb11",
+    image = "debian:bullseye",
+  },
+  ghc = {
+    version = "9.12.4",
+    release_key = "88B57FCF7DB53B4DB3BFA4B1588764FBE22D19C4",
+    assets = {
+      aarch64 = {
+        sha256sum = "e0e2b536e56f08ee9b6eb9c2c4fe43f8d289257afb786ea8f5538c5c7b252f2f",
+        url = "https://downloads.haskell.org/~ghc/9.12.4/ghc-9.12.4-aarch64-deb10-linux.tar.xz",
+      },
+      x86_64 = { sha256sum = "3699fc558231c81836f632f09e36e01381141d7df42ab26a0db6b1b7d0c74f30" },
+    },
+  },
+  cabal_install = {
+    assets = {
+      aarch64 = { sha256sum = "5e8c47a055d5b744741039a7061ee43ec7d080d1251784e7a4cd836403e42523" },
+      x86_64 = { sha256sum = "41b85bb25fa654e4b79169014b9142fe696ff35e002e043caa0e52d65204ba8a" },
+    },
+  },
+}
diff --git a/9.12/bullseye.yaml b/9.12/bullseye.yaml
deleted file mode 100644
index f99a619e..00000000
--- a/9.12/bullseye.yaml
+++ /dev/null
@@ -1,21 +0,0 @@
----
-distro:
-  codename: 'bullseye'
-  abbr: 'deb11'
-  image: 'debian:bullseye'
-ghc:
-  version: "9.12.4"
-  release_key: "88B57FCF7DB53B4DB3BFA4B1588764FBE22D19C4"
-  sha256sum:
-    "aarch64": 'e0e2b536e56f08ee9b6eb9c2c4fe43f8d289257afb786ea8f5538c5c7b252f2f' # hash from deb10 bindist
-    "x86_64": '3699fc558231c81836f632f09e36e01381141d7df42ab26a0db6b1b7d0c74f30'
-cabal_install:
-  sha256sum:
-    "aarch64": '5e8c47a055d5b744741039a7061ee43ec7d080d1251784e7a4cd836403e42523'
-    "x86_64": '41b85bb25fa654e4b79169014b9142fe696ff35e002e043caa0e52d65204ba8a'
-overrides:
-  ghc:
-    "aarch64":
-      # GHC 9.12.4 doesn't have a deb11 bindist for aarch64 for some reason, so we're using the deb10 one instead
-      url: "https://downloads.haskell.org/~ghc/9.12.4/ghc-9.12.4-aarch64-deb10-linux.tar.xz"
-_globals: !include '_globals.yaml'
diff --git a/9.12/slim-bookworm.ncl b/9.12/slim-bookworm.ncl
new file mode 100644
index 00000000..17f527d2
--- /dev/null
+++ b/9.12/slim-bookworm.ncl
@@ -0,0 +1,24 @@
+let globals = import "_globals.ncl"
+in
+globals
+& {
+  distro = {
+    codename = "bookworm",
+    abbr = "deb12",
+    image = "debian:bookworm-slim",
+  },
+  ghc = {
+    version = "9.12.4",
+    release_key = "88B57FCF7DB53B4DB3BFA4B1588764FBE22D19C4",
+    assets = {
+      aarch64 = { sha256sum = "8d093562f4d54b69fc57f94c021138d8595554407bc2828962cf6bdd394a6c97" },
+      x86_64 = { sha256sum = "cdc60a66f1c89604975c896b3c7577b079b602d8fb093af0f4b2b0912fa47bd1" },
+    },
+  },
+  cabal_install = {
+    assets = {
+      aarch64 = { sha256sum = "f763fb2af2bc1ff174b7361a7d51109a585954f87a0e14f86d144f3bce28f7a9" },
+      x86_64 = { sha256sum = "73a463306c771e18ca22c0a9469176ffab0138ec5925adb5364ef47174e1adc5" },
+    },
+  },
+}
diff --git a/9.12/slim-bookworm.yaml b/9.12/slim-bookworm.yaml
deleted file mode 100644
index 0155b4a1..00000000
--- a/9.12/slim-bookworm.yaml
+++ /dev/null
@@ -1,16 +0,0 @@
----
-distro:
-  codename: 'bookworm'
-  abbr: 'deb12'
-  image: 'debian:bookworm-slim'
-ghc:
-  version: "9.12.4"
-  release_key: "88B57FCF7DB53B4DB3BFA4B1588764FBE22D19C4"
-  sha256sum:
-    "aarch64": '8d093562f4d54b69fc57f94c021138d8595554407bc2828962cf6bdd394a6c97'
-    "x86_64": 'cdc60a66f1c89604975c896b3c7577b079b602d8fb093af0f4b2b0912fa47bd1'
-cabal_install:
-  sha256sum:
-    "aarch64": 'f763fb2af2bc1ff174b7361a7d51109a585954f87a0e14f86d144f3bce28f7a9'
-    "x86_64": '73a463306c771e18ca22c0a9469176ffab0138ec5925adb5364ef47174e1adc5'
-_globals: !include '_globals.yaml'
diff --git a/9.12/slim-bullseye.ncl b/9.12/slim-bullseye.ncl
new file mode 100644
index 00000000..d9d5920e
--- /dev/null
+++ b/9.12/slim-bullseye.ncl
@@ -0,0 +1,27 @@
+let globals = import "_globals.ncl"
+in
+globals
+& {
+  distro = {
+    codename = "bullseye",
+    abbr = "deb11",
+    image = "debian:bullseye-slim",
+  },
+  ghc = {
+    version = "9.12.4",
+    release_key = "88B57FCF7DB53B4DB3BFA4B1588764FBE22D19C4",
+    assets = {
+      aarch64 = {
+        sha256sum = "e0e2b536e56f08ee9b6eb9c2c4fe43f8d289257afb786ea8f5538c5c7b252f2f",
+        url = "https://downloads.haskell.org/~ghc/9.12.4/ghc-9.12.4-aarch64-deb10-linux.tar.xz",
+      },
+      x86_64 = { sha256sum = "3699fc558231c81836f632f09e36e01381141d7df42ab26a0db6b1b7d0c74f30" },
+    },
+  },
+  cabal_install = {
+    assets = {
+      aarch64 = { sha256sum = "5e8c47a055d5b744741039a7061ee43ec7d080d1251784e7a4cd836403e42523" },
+      x86_64 = { sha256sum = "41b85bb25fa654e4b79169014b9142fe696ff35e002e043caa0e52d65204ba8a" },
+    },
+  },
+}
diff --git a/9.12/slim-bullseye.yaml b/9.12/slim-bullseye.yaml
deleted file mode 100644
index f60d1ea5..00000000
--- a/9.12/slim-bullseye.yaml
+++ /dev/null
@@ -1,21 +0,0 @@
----
-distro:
-  codename: 'bullseye'
-  abbr: 'deb11'
-  image: 'debian:bullseye-slim'
-ghc:
-  version: "9.12.4"
-  release_key: "88B57FCF7DB53B4DB3BFA4B1588764FBE22D19C4"
-  sha256sum:
-    "aarch64": 'e0e2b536e56f08ee9b6eb9c2c4fe43f8d289257afb786ea8f5538c5c7b252f2f' # hash from deb10 bindist
-    "x86_64": '3699fc558231c81836f632f09e36e01381141d7df42ab26a0db6b1b7d0c74f30'
-cabal_install:
-  sha256sum:
-    "aarch64": '5e8c47a055d5b744741039a7061ee43ec7d080d1251784e7a4cd836403e42523'
-    "x86_64": '41b85bb25fa654e4b79169014b9142fe696ff35e002e043caa0e52d65204ba8a'
-overrides:
-  ghc:
-    "aarch64":
-      # GHC 9.12.4 doesn't have a deb11 bindist for aarch64 for some reason, so we're using the deb10 one instead
-      url: "https://downloads.haskell.org/~ghc/9.12.4/ghc-9.12.4-aarch64-deb10-linux.tar.xz"
-_globals: !include '_globals.yaml'
diff --git a/9.14/_globals.ncl b/9.14/_globals.ncl
new file mode 100644
index 00000000..95a8d0d2
--- /dev/null
+++ b/9.14/_globals.ncl
@@ -0,0 +1,14 @@
+{
+  stack = {
+    version = "3.3.1",
+    release_key = "C5705533DA4F78D8664B5DC0575159689BEFB442",
+    assets = {
+      aarch64 = { sha256sum = "bdd618ea5a9c921417727011f2ecd78987dffa5cee5e741108baf65a9b5b58ab" },
+      x86_64 = { sha256sum = "88d7e517342c125b0a098d9d578fe53e590618ae4b2427283a27408a1ebd06d8" },
+    },
+  },
+  cabal_install = {
+    version = "3.16.1.0",
+    release_key = "1E07C9A1A3088BAD47F74A3E227EE1942B0BDB95",
+  },
+}
diff --git a/9.14/_globals.yaml b/9.14/_globals.yaml
deleted file mode 100644
index 4d96c1bd..00000000
--- a/9.14/_globals.yaml
+++ /dev/null
@@ -1,9 +0,0 @@
-stack:
-  version: "3.3.1"
-  release_key: "C5705533DA4F78D8664B5DC0575159689BEFB442"
-  sha256sum:
-    "aarch64": 'bdd618ea5a9c921417727011f2ecd78987dffa5cee5e741108baf65a9b5b58ab'
-    "x86_64": '88d7e517342c125b0a098d9d578fe53e590618ae4b2427283a27408a1ebd06d8'
-cabal_install:
-  version: "3.16.1.0"
-  release_key: "1E07C9A1A3088BAD47F74A3E227EE1942B0BDB95"
diff --git a/9.14/bookworm.ncl b/9.14/bookworm.ncl
new file mode 100644
index 00000000..d181e9f1
--- /dev/null
+++ b/9.14/bookworm.ncl
@@ -0,0 +1,24 @@
+let globals = import "_globals.ncl"
+in
+globals
+& {
+  distro = {
+    codename = "bookworm",
+    abbr = "deb12",
+    image = "debian:bookworm",
+  },
+  ghc = {
+    version = "9.14.1",
+    release_key = "88B57FCF7DB53B4DB3BFA4B1588764FBE22D19C4",
+    assets = {
+      aarch64 = { sha256sum = "6aa27a377451851c851eefdd869e8f5a9217b02ce66c6ca9b418b72efee28427" },
+      x86_64 = { sha256sum = "60f7ab75f28df892729fbaff3a54f58ee3ad7e731929f1b2f3eb0208f73de841" },
+    },
+  },
+  cabal_install = {
+    assets = {
+      aarch64 = { sha256sum = "41d8fc43de1c652c00d85799d0273f8b6600bc71603126bc651ca4e3917a1b84" },
+      x86_64 = { sha256sum = "209987f6abdd1119f6b2674a0d1012857a783464774708cb4f3fd9e156ea7bea" },
+    },
+  },
+}
diff --git a/9.14/bookworm.yaml b/9.14/bookworm.yaml
deleted file mode 100644
index adb58a42..00000000
--- a/9.14/bookworm.yaml
+++ /dev/null
@@ -1,16 +0,0 @@
----
-distro:
-  codename: 'bookworm'
-  abbr: 'deb12'
-  image: 'debian:bookworm'
-ghc:
-  version: "9.14.1"
-  release_key: "88B57FCF7DB53B4DB3BFA4B1588764FBE22D19C4"
-  sha256sum:
-    "aarch64": '6aa27a377451851c851eefdd869e8f5a9217b02ce66c6ca9b418b72efee28427'
-    "x86_64": '60f7ab75f28df892729fbaff3a54f58ee3ad7e731929f1b2f3eb0208f73de841'
-cabal_install:
-  sha256sum:
-    "aarch64": '41d8fc43de1c652c00d85799d0273f8b6600bc71603126bc651ca4e3917a1b84'
-    "x86_64": '209987f6abdd1119f6b2674a0d1012857a783464774708cb4f3fd9e156ea7bea'
-_globals: !include '_globals.yaml'
diff --git a/9.14/bullseye.ncl b/9.14/bullseye.ncl
new file mode 100644
index 00000000..ae9bd2ed
--- /dev/null
+++ b/9.14/bullseye.ncl
@@ -0,0 +1,27 @@
+let globals = import "_globals.ncl"
+in
+globals
+& {
+  distro = {
+    codename = "bullseye",
+    abbr = "deb11",
+    image = "debian:bullseye",
+  },
+  ghc = {
+    version = "9.14.1",
+    release_key = "88B57FCF7DB53B4DB3BFA4B1588764FBE22D19C4",
+    assets = {
+      aarch64 = {
+        sha256sum = "526c352cceddbf6c580e17ade7e782e3b21b4182d328b2d454c9f13ca7c08992",
+        url = "https://downloads.haskell.org/~ghc/9.14.1/ghc-9.14.1-aarch64-deb10-linux.tar.xz",
+      },
+      x86_64 = { sha256sum = "98f42ba5b44e50d680434b9d3c7ad51b257678899cf7f806a0c85cf63b6d1095" },
+    },
+  },
+  cabal_install = {
+    assets = {
+      aarch64 = { sha256sum = "6c5b74781d64266fa060099502d33b1f8297f269a5f71eda871b7db7fb3bf8e4" },
+      x86_64 = { sha256sum = "0af41eac80718dc4396340cffa2dbf525e777ec3e877f689718a9ef5aedcb6ab" },
+    },
+  },
+}
diff --git a/9.14/bullseye.yaml b/9.14/bullseye.yaml
deleted file mode 100644
index 1c1ed838..00000000
--- a/9.14/bullseye.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
----
-distro:
-  codename: 'bullseye'
-  abbr: 'deb11'
-  image: 'debian:bullseye'
-ghc:
-  version: "9.14.1"
-  release_key: "88B57FCF7DB53B4DB3BFA4B1588764FBE22D19C4"
-  sha256sum:
-    "aarch64": '526c352cceddbf6c580e17ade7e782e3b21b4182d328b2d454c9f13ca7c08992' # hash from deb10 bindist
-    "x86_64": '98f42ba5b44e50d680434b9d3c7ad51b257678899cf7f806a0c85cf63b6d1095'
-cabal_install:
-  sha256sum:
-    "aarch64": '6c5b74781d64266fa060099502d33b1f8297f269a5f71eda871b7db7fb3bf8e4'
-    "x86_64": '0af41eac80718dc4396340cffa2dbf525e777ec3e877f689718a9ef5aedcb6ab'
-overrides:
-  ghc:
-    "aarch64":
-      # GHC 9.14.1 doesn't have a deb11 bindist for aarch64 for some reason, so we're using the deb10 one instead
-      url: "https://downloads.haskell.org/~ghc/9.14.1/ghc-9.14.1-aarch64-deb10-linux.tar.xz"
-_globals: !include '_globals.yaml'
-
diff --git a/9.14/slim-bookworm.ncl b/9.14/slim-bookworm.ncl
new file mode 100644
index 00000000..1421dbef
--- /dev/null
+++ b/9.14/slim-bookworm.ncl
@@ -0,0 +1,24 @@
+let globals = import "_globals.ncl"
+in
+globals
+& {
+  distro = {
+    codename = "bookworm",
+    abbr = "deb12",
+    image = "debian:bookworm-slim",
+  },
+  ghc = {
+    version = "9.14.1",
+    release_key = "88B57FCF7DB53B4DB3BFA4B1588764FBE22D19C4",
+    assets = {
+      aarch64 = { sha256sum = "6aa27a377451851c851eefdd869e8f5a9217b02ce66c6ca9b418b72efee28427" },
+      x86_64 = { sha256sum = "60f7ab75f28df892729fbaff3a54f58ee3ad7e731929f1b2f3eb0208f73de841" },
+    },
+  },
+  cabal_install = {
+    assets = {
+      aarch64 = { sha256sum = "41d8fc43de1c652c00d85799d0273f8b6600bc71603126bc651ca4e3917a1b84" },
+      x86_64 = { sha256sum = "209987f6abdd1119f6b2674a0d1012857a783464774708cb4f3fd9e156ea7bea" },
+    },
+  },
+}
diff --git a/9.14/slim-bookworm.yaml b/9.14/slim-bookworm.yaml
deleted file mode 100644
index 748c6d79..00000000
--- a/9.14/slim-bookworm.yaml
+++ /dev/null
@@ -1,16 +0,0 @@
----
-distro:
-  codename: 'bookworm'
-  abbr: 'deb12'
-  image: 'debian:bookworm-slim'
-ghc:
-  version: "9.14.1"
-  release_key: "88B57FCF7DB53B4DB3BFA4B1588764FBE22D19C4"
-  sha256sum:
-    "aarch64": '6aa27a377451851c851eefdd869e8f5a9217b02ce66c6ca9b418b72efee28427'
-    "x86_64": '60f7ab75f28df892729fbaff3a54f58ee3ad7e731929f1b2f3eb0208f73de841'
-cabal_install:
-  sha256sum:
-    "aarch64": '41d8fc43de1c652c00d85799d0273f8b6600bc71603126bc651ca4e3917a1b84'
-    "x86_64": '209987f6abdd1119f6b2674a0d1012857a783464774708cb4f3fd9e156ea7bea'
-_globals: !include '_globals.yaml'
diff --git a/9.14/slim-bullseye.ncl b/9.14/slim-bullseye.ncl
new file mode 100644
index 00000000..0e3d1568
--- /dev/null
+++ b/9.14/slim-bullseye.ncl
@@ -0,0 +1,27 @@
+let globals = import "_globals.ncl"
+in
+globals
+& {
+  distro = {
+    codename = "bullseye",
+    abbr = "deb11",
+    image = "debian:bullseye-slim",
+  },
+  ghc = {
+    version = "9.14.1",
+    release_key = "88B57FCF7DB53B4DB3BFA4B1588764FBE22D19C4",
+    assets = {
+      aarch64 = {
+        sha256sum = "526c352cceddbf6c580e17ade7e782e3b21b4182d328b2d454c9f13ca7c08992",
+        url = "https://downloads.haskell.org/~ghc/9.14.1/ghc-9.14.1-aarch64-deb10-linux.tar.xz",
+      },
+      x86_64 = { sha256sum = "98f42ba5b44e50d680434b9d3c7ad51b257678899cf7f806a0c85cf63b6d1095" },
+    },
+  },
+  cabal_install = {
+    assets = {
+      aarch64 = { sha256sum = "6c5b74781d64266fa060099502d33b1f8297f269a5f71eda871b7db7fb3bf8e4" },
+      x86_64 = { sha256sum = "0af41eac80718dc4396340cffa2dbf525e777ec3e877f689718a9ef5aedcb6ab" },
+    },
+  },
+}
diff --git a/9.14/slim-bullseye.yaml b/9.14/slim-bullseye.yaml
deleted file mode 100644
index 60da35d6..00000000
--- a/9.14/slim-bullseye.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
----
-distro:
-  codename: 'bullseye'
-  abbr: 'deb11'
-  image: 'debian:bullseye-slim'
-ghc:
-  version: "9.14.1"
-  release_key: "88B57FCF7DB53B4DB3BFA4B1588764FBE22D19C4"
-  sha256sum:
-    "aarch64": '526c352cceddbf6c580e17ade7e782e3b21b4182d328b2d454c9f13ca7c08992' # hash from deb10 bindist
-    "x86_64": '98f42ba5b44e50d680434b9d3c7ad51b257678899cf7f806a0c85cf63b6d1095'
-cabal_install:
-  sha256sum:
-    "aarch64": '6c5b74781d64266fa060099502d33b1f8297f269a5f71eda871b7db7fb3bf8e4'
-    "x86_64": '0af41eac80718dc4396340cffa2dbf525e777ec3e877f689718a9ef5aedcb6ab'
-overrides:
-  ghc:
-    "aarch64":
-      # GHC 9.14.1 doesn't have a deb11 bindist for aarch64 for some reason, so we're using the deb10 one instead
-      url: "https://downloads.haskell.org/~ghc/9.14.1/ghc-9.14.1-aarch64-deb10-linux.tar.xz"
-_globals: !include '_globals.yaml'
-
diff --git a/9.4/_cabal-install.ncl b/9.4/_cabal-install.ncl
new file mode 100644
index 00000000..d71ac774
--- /dev/null
+++ b/9.4/_cabal-install.ncl
@@ -0,0 +1,6 @@
+{
+  assets = {
+    aarch64 = { sha256sum = "5e8c47a055d5b744741039a7061ee43ec7d080d1251784e7a4cd836403e42523" },
+    x86_64 = { sha256sum = "41b85bb25fa654e4b79169014b9142fe696ff35e002e043caa0e52d65204ba8a" },
+  },
+}
diff --git a/9.4/_cabal-install.yaml b/9.4/_cabal-install.yaml
deleted file mode 100644
index ca8620e1..00000000
--- a/9.4/_cabal-install.yaml
+++ /dev/null
@@ -1,3 +0,0 @@
-sha256sum:
-  "aarch64": '5e8c47a055d5b744741039a7061ee43ec7d080d1251784e7a4cd836403e42523'
-  "x86_64": '41b85bb25fa654e4b79169014b9142fe696ff35e002e043caa0e52d65204ba8a'
diff --git a/9.4/_ghc.ncl b/9.4/_ghc.ncl
new file mode 100644
index 00000000..12ffaf65
--- /dev/null
+++ b/9.4/_ghc.ncl
@@ -0,0 +1,11 @@
+{
+  version = "9.4.8",
+  release_key = "88B57FCF7DB53B4DB3BFA4B1588764FBE22D19C4",
+  assets = {
+    aarch64 = {
+      sha256sum = "278e287e1ee624712b9c6d7803d1cf915ca1cce56e013b0a16215eb8dfeb1531",
+      url = "https://downloads.haskell.org/~ghc/9.4.8/ghc-9.4.8-aarch64-deb10-linux.tar.xz",
+    },
+    x86_64 = { sha256sum = "2743629d040f3213499146cb5154621d6f25e85271019afc9b9009e04d66bf6c" },
+  },
+}
diff --git a/9.4/_ghc.yaml b/9.4/_ghc.yaml
deleted file mode 100644
index f31e1d09..00000000
--- a/9.4/_ghc.yaml
+++ /dev/null
@@ -1,5 +0,0 @@
-version: "9.4.8"
-release_key: "88B57FCF7DB53B4DB3BFA4B1588764FBE22D19C4"
-sha256sum:
-  "aarch64": '278e287e1ee624712b9c6d7803d1cf915ca1cce56e013b0a16215eb8dfeb1531'
-  "x86_64": '2743629d040f3213499146cb5154621d6f25e85271019afc9b9009e04d66bf6c'
diff --git a/9.4/_globals.ncl b/9.4/_globals.ncl
new file mode 100644
index 00000000..f1947ff7
--- /dev/null
+++ b/9.4/_globals.ncl
@@ -0,0 +1,14 @@
+{
+  stack = {
+    version = "3.3.1",
+    release_key = "C5705533DA4F78D8664B5DC0575159689BEFB442",
+    assets = {
+      aarch64 = { sha256sum = "bdd618ea5a9c921417727011f2ecd78987dffa5cee5e741108baf65a9b5b58ab" },
+      x86_64 = { sha256sum = "88d7e517342c125b0a098d9d578fe53e590618ae4b2427283a27408a1ebd06d8" },
+    },
+  },
+  cabal_install = {
+    version = "3.14.1.1",
+    release_key = "EAF2A9A722C0C96F2B431CA511AAD8CEDEE0CAEF",
+  },
+}
diff --git a/9.4/_globals.yaml b/9.4/_globals.yaml
deleted file mode 100644
index a6d67e60..00000000
--- a/9.4/_globals.yaml
+++ /dev/null
@@ -1,9 +0,0 @@
-stack:
-  version: "3.3.1"
-  release_key: "C5705533DA4F78D8664B5DC0575159689BEFB442"
-  sha256sum:
-    "aarch64": 'bdd618ea5a9c921417727011f2ecd78987dffa5cee5e741108baf65a9b5b58ab'
-    "x86_64": '88d7e517342c125b0a098d9d578fe53e590618ae4b2427283a27408a1ebd06d8'
-cabal_install:
-  version: "3.14.1.1"
-  release_key: "EAF2A9A722C0C96F2B431CA511AAD8CEDEE0CAEF"
diff --git a/9.4/bullseye.ncl b/9.4/bullseye.ncl
new file mode 100644
index 00000000..69214d23
--- /dev/null
+++ b/9.4/bullseye.ncl
@@ -0,0 +1,12 @@
+let globals = import "_globals.ncl"
+in
+globals
+& {
+  distro = {
+    codename = "bullseye",
+    abbr = "deb11",
+    image = "debian:bullseye",
+  },
+  ghc = import "_ghc.ncl",
+  cabal_install = import "_cabal-install.ncl",
+}
diff --git a/9.4/bullseye.yaml b/9.4/bullseye.yaml
deleted file mode 100644
index dd37c20a..00000000
--- a/9.4/bullseye.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
----
-distro:
-  codename: 'bullseye'
-  abbr: 'deb11'
-  image: 'debian:bullseye'
-ghc: !include '_ghc.yaml'
-cabal_install: !include '_cabal-install.yaml'
-overrides:
-  ghc:
-    "aarch64":
-      # GHC 9.4.8 doesn't have a deb11 bindist for aarch64 for some reason, so we're using the deb10 one instead
-      url: "https://downloads.haskell.org/~ghc/9.4.8/ghc-9.4.8-aarch64-deb10-linux.tar.xz"
-_globals: !include '_globals.yaml'
diff --git a/9.4/slim-bullseye.ncl b/9.4/slim-bullseye.ncl
new file mode 100644
index 00000000..13f6ea51
--- /dev/null
+++ b/9.4/slim-bullseye.ncl
@@ -0,0 +1,12 @@
+let globals = import "_globals.ncl"
+in
+globals
+& {
+  distro = {
+    codename = "bullseye",
+    abbr = "deb11",
+    image = "debian:bullseye-slim",
+  },
+  ghc = import "_ghc.ncl",
+  cabal_install = import "_cabal-install.ncl",
+}
diff --git a/9.4/slim-bullseye.yaml b/9.4/slim-bullseye.yaml
deleted file mode 100644
index 5f8f987f..00000000
--- a/9.4/slim-bullseye.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
----
-distro:
-  codename: 'bullseye'
-  abbr: 'deb11'
-  image: 'debian:bullseye-slim'
-ghc: !include '_ghc.yaml'
-cabal_install: !include '_cabal-install.yaml'
-overrides:
-  ghc:
-    "aarch64":
-      # GHC 9.4.8 doesn't have a deb11 bindist for aarch64 for some reason, so we're using the deb10 one instead
-      url: "https://downloads.haskell.org/~ghc/9.4.8/ghc-9.4.8-aarch64-deb10-linux.tar.xz"
-_globals: !include '_globals.yaml'
diff --git a/9.6/_cabal-install.ncl b/9.6/_cabal-install.ncl
new file mode 100644
index 00000000..d71ac774
--- /dev/null
+++ b/9.6/_cabal-install.ncl
@@ -0,0 +1,6 @@
+{
+  assets = {
+    aarch64 = { sha256sum = "5e8c47a055d5b744741039a7061ee43ec7d080d1251784e7a4cd836403e42523" },
+    x86_64 = { sha256sum = "41b85bb25fa654e4b79169014b9142fe696ff35e002e043caa0e52d65204ba8a" },
+  },
+}
diff --git a/9.6/_cabal-install.yaml b/9.6/_cabal-install.yaml
deleted file mode 100644
index ca8620e1..00000000
--- a/9.6/_cabal-install.yaml
+++ /dev/null
@@ -1,3 +0,0 @@
-sha256sum:
-  "aarch64": '5e8c47a055d5b744741039a7061ee43ec7d080d1251784e7a4cd836403e42523'
-  "x86_64": '41b85bb25fa654e4b79169014b9142fe696ff35e002e043caa0e52d65204ba8a'
diff --git a/9.6/_ghc.ncl b/9.6/_ghc.ncl
new file mode 100644
index 00000000..45d6b9b4
--- /dev/null
+++ b/9.6/_ghc.ncl
@@ -0,0 +1,11 @@
+{
+  version = "9.6.7",
+  release_key = "8C961469C8FDC968718D6245AC7DE836C5DF907D",
+  assets = {
+    aarch64 = {
+      sha256sum = "3cfa843687856de304a946dbe849a497c4fdad021f0275628b8ca7b55ccf8082",
+      url = "https://downloads.haskell.org/~ghc/9.6.7/ghc-9.6.7-aarch64-deb10-linux.tar.xz",
+    },
+    x86_64 = { sha256sum = "fc6a6247d1831745c67b27d6212f6911c35a933043f3b6851724e2e01484d077" },
+  },
+}
diff --git a/9.6/_ghc.yaml b/9.6/_ghc.yaml
deleted file mode 100644
index 1461e4e8..00000000
--- a/9.6/_ghc.yaml
+++ /dev/null
@@ -1,5 +0,0 @@
-version: "9.6.7"
-release_key: "8C961469C8FDC968718D6245AC7DE836C5DF907D"
-sha256sum:
-  "aarch64": '3cfa843687856de304a946dbe849a497c4fdad021f0275628b8ca7b55ccf8082'
-  "x86_64": 'fc6a6247d1831745c67b27d6212f6911c35a933043f3b6851724e2e01484d077'
diff --git a/9.6/_globals.ncl b/9.6/_globals.ncl
new file mode 100644
index 00000000..f1947ff7
--- /dev/null
+++ b/9.6/_globals.ncl
@@ -0,0 +1,14 @@
+{
+  stack = {
+    version = "3.3.1",
+    release_key = "C5705533DA4F78D8664B5DC0575159689BEFB442",
+    assets = {
+      aarch64 = { sha256sum = "bdd618ea5a9c921417727011f2ecd78987dffa5cee5e741108baf65a9b5b58ab" },
+      x86_64 = { sha256sum = "88d7e517342c125b0a098d9d578fe53e590618ae4b2427283a27408a1ebd06d8" },
+    },
+  },
+  cabal_install = {
+    version = "3.14.1.1",
+    release_key = "EAF2A9A722C0C96F2B431CA511AAD8CEDEE0CAEF",
+  },
+}
diff --git a/9.6/_globals.yaml b/9.6/_globals.yaml
deleted file mode 100644
index a6d67e60..00000000
--- a/9.6/_globals.yaml
+++ /dev/null
@@ -1,9 +0,0 @@
-stack:
-  version: "3.3.1"
-  release_key: "C5705533DA4F78D8664B5DC0575159689BEFB442"
-  sha256sum:
-    "aarch64": 'bdd618ea5a9c921417727011f2ecd78987dffa5cee5e741108baf65a9b5b58ab'
-    "x86_64": '88d7e517342c125b0a098d9d578fe53e590618ae4b2427283a27408a1ebd06d8'
-cabal_install:
-  version: "3.14.1.1"
-  release_key: "EAF2A9A722C0C96F2B431CA511AAD8CEDEE0CAEF"
diff --git a/9.6/bullseye.ncl b/9.6/bullseye.ncl
new file mode 100644
index 00000000..69214d23
--- /dev/null
+++ b/9.6/bullseye.ncl
@@ -0,0 +1,12 @@
+let globals = import "_globals.ncl"
+in
+globals
+& {
+  distro = {
+    codename = "bullseye",
+    abbr = "deb11",
+    image = "debian:bullseye",
+  },
+  ghc = import "_ghc.ncl",
+  cabal_install = import "_cabal-install.ncl",
+}
diff --git a/9.6/bullseye.yaml b/9.6/bullseye.yaml
deleted file mode 100644
index 83613f9f..00000000
--- a/9.6/bullseye.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
----
-distro:
-  codename: 'bullseye'
-  abbr: 'deb11'
-  image: 'debian:bullseye'
-ghc: !include '_ghc.yaml'
-cabal_install: !include '_cabal-install.yaml'
-overrides:
-  ghc:
-    "aarch64":
-      # GHC 9.6.7 doesn't have a deb11 bindist for aarch64 for some reason, so we're using the deb10 one instead
-      url: "https://downloads.haskell.org/~ghc/9.6.7/ghc-9.6.7-aarch64-deb10-linux.tar.xz"
-_globals: !include '_globals.yaml'
diff --git a/9.6/slim-bullseye.ncl b/9.6/slim-bullseye.ncl
new file mode 100644
index 00000000..13f6ea51
--- /dev/null
+++ b/9.6/slim-bullseye.ncl
@@ -0,0 +1,12 @@
+let globals = import "_globals.ncl"
+in
+globals
+& {
+  distro = {
+    codename = "bullseye",
+    abbr = "deb11",
+    image = "debian:bullseye-slim",
+  },
+  ghc = import "_ghc.ncl",
+  cabal_install = import "_cabal-install.ncl",
+}
diff --git a/9.6/slim-bullseye.yaml b/9.6/slim-bullseye.yaml
deleted file mode 100644
index cee76810..00000000
--- a/9.6/slim-bullseye.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
----
-distro:
-  codename: 'bullseye'
-  abbr: 'deb11'
-  image: 'debian:bullseye-slim'
-ghc: !include '_ghc.yaml'
-cabal_install: !include '_cabal-install.yaml'
-overrides:
-  ghc:
-    "aarch64":
-      # GHC 9.6.7 doesn't have a deb11 bindist for aarch64 for some reason, so we're using the deb10 one instead
-      url: "https://downloads.haskell.org/~ghc/9.6.7/ghc-9.6.7-aarch64-deb10-linux.tar.xz"
-_globals: !include '_globals.yaml'
diff --git a/9.8/_cabal-install.ncl b/9.8/_cabal-install.ncl
new file mode 100644
index 00000000..d71ac774
--- /dev/null
+++ b/9.8/_cabal-install.ncl
@@ -0,0 +1,6 @@
+{
+  assets = {
+    aarch64 = { sha256sum = "5e8c47a055d5b744741039a7061ee43ec7d080d1251784e7a4cd836403e42523" },
+    x86_64 = { sha256sum = "41b85bb25fa654e4b79169014b9142fe696ff35e002e043caa0e52d65204ba8a" },
+  },
+}
diff --git a/9.8/_cabal-install.yaml b/9.8/_cabal-install.yaml
deleted file mode 100644
index ca8620e1..00000000
--- a/9.8/_cabal-install.yaml
+++ /dev/null
@@ -1,3 +0,0 @@
-sha256sum:
-  "aarch64": '5e8c47a055d5b744741039a7061ee43ec7d080d1251784e7a4cd836403e42523'
-  "x86_64": '41b85bb25fa654e4b79169014b9142fe696ff35e002e043caa0e52d65204ba8a'
diff --git a/9.8/_ghc.ncl b/9.8/_ghc.ncl
new file mode 100644
index 00000000..84482f5b
--- /dev/null
+++ b/9.8/_ghc.ncl
@@ -0,0 +1,8 @@
+{
+  version = "9.8.4",
+  release_key = "FFEB7CE81E16A36B3E2DED6F2DE04D4E97DB64AD",
+  assets = {
+    aarch64 = { sha256sum = "310204daf2df6ad16087be94b3498ca414a0953b29e94e8ec8eb4a5c9bf603d3" },
+    x86_64 = { sha256sum = "af151db8682b8c763f5a44f960f65453d794c95b60f151abc82dbdefcbe6f8ad" },
+  },
+}
diff --git a/9.8/_ghc.yaml b/9.8/_ghc.yaml
deleted file mode 100644
index 6140f876..00000000
--- a/9.8/_ghc.yaml
+++ /dev/null
@@ -1,5 +0,0 @@
-version: "9.8.4"
-release_key: "FFEB7CE81E16A36B3E2DED6F2DE04D4E97DB64AD"
-sha256sum:
-  "aarch64": '310204daf2df6ad16087be94b3498ca414a0953b29e94e8ec8eb4a5c9bf603d3'
-  "x86_64": 'af151db8682b8c763f5a44f960f65453d794c95b60f151abc82dbdefcbe6f8ad'
diff --git a/9.8/_globals.ncl b/9.8/_globals.ncl
new file mode 100644
index 00000000..f1947ff7
--- /dev/null
+++ b/9.8/_globals.ncl
@@ -0,0 +1,14 @@
+{
+  stack = {
+    version = "3.3.1",
+    release_key = "C5705533DA4F78D8664B5DC0575159689BEFB442",
+    assets = {
+      aarch64 = { sha256sum = "bdd618ea5a9c921417727011f2ecd78987dffa5cee5e741108baf65a9b5b58ab" },
+      x86_64 = { sha256sum = "88d7e517342c125b0a098d9d578fe53e590618ae4b2427283a27408a1ebd06d8" },
+    },
+  },
+  cabal_install = {
+    version = "3.14.1.1",
+    release_key = "EAF2A9A722C0C96F2B431CA511AAD8CEDEE0CAEF",
+  },
+}
diff --git a/9.8/_globals.yaml b/9.8/_globals.yaml
deleted file mode 100644
index a6d67e60..00000000
--- a/9.8/_globals.yaml
+++ /dev/null
@@ -1,9 +0,0 @@
-stack:
-  version: "3.3.1"
-  release_key: "C5705533DA4F78D8664B5DC0575159689BEFB442"
-  sha256sum:
-    "aarch64": 'bdd618ea5a9c921417727011f2ecd78987dffa5cee5e741108baf65a9b5b58ab'
-    "x86_64": '88d7e517342c125b0a098d9d578fe53e590618ae4b2427283a27408a1ebd06d8'
-cabal_install:
-  version: "3.14.1.1"
-  release_key: "EAF2A9A722C0C96F2B431CA511AAD8CEDEE0CAEF"
diff --git a/9.8/bullseye.ncl b/9.8/bullseye.ncl
new file mode 100644
index 00000000..69214d23
--- /dev/null
+++ b/9.8/bullseye.ncl
@@ -0,0 +1,12 @@
+let globals = import "_globals.ncl"
+in
+globals
+& {
+  distro = {
+    codename = "bullseye",
+    abbr = "deb11",
+    image = "debian:bullseye",
+  },
+  ghc = import "_ghc.ncl",
+  cabal_install = import "_cabal-install.ncl",
+}
diff --git a/9.8/bullseye.yaml b/9.8/bullseye.yaml
deleted file mode 100644
index 4e3cc203..00000000
--- a/9.8/bullseye.yaml
+++ /dev/null
@@ -1,9 +0,0 @@
----
-distro:
-  codename: 'bullseye'
-  abbr: 'deb11'
-  image: 'debian:bullseye'
-ghc: !include '_ghc.yaml'
-cabal_install: !include '_cabal-install.yaml'
-_globals: !include '_globals.yaml'
-
diff --git a/9.8/slim-bullseye.ncl b/9.8/slim-bullseye.ncl
new file mode 100644
index 00000000..13f6ea51
--- /dev/null
+++ b/9.8/slim-bullseye.ncl
@@ -0,0 +1,12 @@
+let globals = import "_globals.ncl"
+in
+globals
+& {
+  distro = {
+    codename = "bullseye",
+    abbr = "deb11",
+    image = "debian:bullseye-slim",
+  },
+  ghc = import "_ghc.ncl",
+  cabal_install = import "_cabal-install.ncl",
+}
diff --git a/9.8/slim-bullseye.yaml b/9.8/slim-bullseye.yaml
deleted file mode 100644
index d60aeff8..00000000
--- a/9.8/slim-bullseye.yaml
+++ /dev/null
@@ -1,9 +0,0 @@
----
-distro:
-  codename: 'bullseye'
-  abbr: 'deb11'
-  image: 'debian:bullseye-slim'
-ghc: !include '_ghc.yaml'
-cabal_install: !include '_cabal-install.yaml'
-_globals: !include '_globals.yaml'
-
diff --git a/README.md b/README.md
index 6d5d2934..62af8cbe 100644
--- a/README.md
+++ b/README.md
@@ -74,37 +74,31 @@ For actively supported GHC versions, Cabal and Stack should be updated when new
 
 ### Generating Dockerfiles
 
-Dockerfiles are generated from `template/Dockerfile.jinja` using YAML data files.
-
-Build the generator (one-time or after generator changes):
-
-```bash
-cd generator
-stack build
-```
+Dockerfiles are generated from `template/Dockerfile.ncl` using Nickel data files.
 
 Regenerate a Dockerfile from the repository root with the helper script:
 
 ```bash
-./generate.sh 9.14/bookworm.yaml 9.14/bookworm/Dockerfile
+./generate.sh 9.14/bookworm.ncl 9.14/bookworm/Dockerfile
 ```
 
-You can also run the generator directly:
+You can also run Nickel directly:
 
 ```bash
-cd generator
-stack run -- -t ../template/Dockerfile.jinja --data-file ../9.14/bookworm.yaml > ../9.14/bookworm/Dockerfile
+nickel export --format text -o 9.14/bookworm/Dockerfile - <<'EOF'
+let render = import "template/Dockerfile.ncl" in
+let config = import "9.14/bookworm.ncl" in
+render config
+EOF
 ```
 
 General layout:
 
-- `<GHC line>/<variant>.yaml` (for example `9.14/bookworm.yaml`) contains distro-specific values
-- `<GHC line>/_globals.yaml` contains shared values (for example Stack and cabal-install versions)
-- some lines also use shared fragments like `<GHC line>/_ghc.yaml` and `<GHC line>/_cabal-install*.yaml`
+- `<GHC line>/<variant>.ncl` (for example `9.14/bookworm.ncl`) contains distro-specific values
+- `<GHC line>/_globals.ncl` contains shared values (for example Stack and cabal-install versions)
+- some lines also use shared fragments like `<GHC line>/_ghc.ncl` and `<GHC line>/_cabal-install*.ncl`
 - `<GHC line>/<variant>/Dockerfile` is the generated output
 
-The generator can print a few `RuntimeError` messages related to missing override keys; these are usually harmless.
-
 ### Building and Running Locally
 
 ```bash
@@ -123,14 +117,14 @@ This is a two-step process:
 
 When GHC, cabal-install, or Stack releases a new version:
 
-1. Update versions, checksums, and release keys in the relevant YAML files.
+1. Update versions, checksums, and release keys in the relevant Nickel files.
 2. Regenerate affected Dockerfiles.
 3. Build and smoke-test locally.
 4. Open a PR and make sure CI passes.
 
 ##### GHC
 
-1. Bump the GHC version in relevant YAML files (for example `9.12.4` -> `9.12.5`).
+1. Bump the GHC version in relevant `.ncl` files (for example `9.12.4` -> `9.12.5`).
 2. Download checksums from `https://downloads.haskell.org/~ghc/<version>/SHA256SUMS`.
 3. Update the `x86_64` and `aarch64` checksums for each affected distro/bindist.
 4. If a bindist is missing for a target distro, add or update an override URL (see existing `overrides.ghc.aarch64.url` usage).
@@ -144,7 +138,7 @@ Known GHC releasers:
 
 ##### cabal-install
 
-1. Bump the cabal-install version in relevant `_globals.yaml` files.
+1. Bump the cabal-install version in relevant `_globals.ncl` files.
 2. Download checksums from `https://downloads.haskell.org/~cabal/cabal-install-<version>/SHA256SUMS`.
 3. Update checksums for the expected bindists (for example `x86_64-linux-deb11`, `aarch64-linux-deb11`, 
    `x86_64-linux-deb12`, `aarch64-linux-deb12`, as needed by the affected lines).
@@ -157,7 +151,7 @@ Known cabal-install releasers:
 
 ##### Stack
 
-1. Bump the Stack version in relevant `_globals.yaml` files.
+1. Bump the Stack version in relevant `_globals.ncl` files.
 2. Download checksums from the Stack release assets (for example `stack-<version>-linux-x86_64.tar.gz.sha256` 
    and `stack-<version>-linux-aarch64.tar.gz.sha256`).
 3. Update both architecture checksums.
diff --git a/generate.sh b/generate.sh
index 7a007e4e..1d20a8ba 100755
--- a/generate.sh
+++ b/generate.sh
@@ -1,24 +1,47 @@
 #!/usr/bin/env bash
 set -e
 set -o pipefail
+set -x
 
 main() {
   if [ "$#" -ne 2 ]; then
-    echo "Usage: $0 <data-file> <output-file>"
+    echo "Usage: $0 <data-file.ncl> <output-file>"
     exit 1
   fi
+
   local script_dir
   script_dir=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
   cd "$script_dir" || exit 1
-  local abs_data_file
-  abs_data_file=$(realpath "$1")
-  local abs_output_file
-  abs_output_file=$(realpath "$2")
-  local template_path
-  template_path=$(realpath ./template/Dockerfile.jinja)
-  # run the generator
-  pushd generator || exit 1
-  stack run -- -t "$template_path" --data-file "$abs_data_file" > "$abs_output_file"
-  popd || exit 1
+
+  local data_file
+  data_file=$(realpath "$1")
+  local output_file
+  output_file=$(realpath "$2")
+
+  if [ ! -f "$data_file" ]; then
+    echo "error: data file not found: $data_file"
+    exit 1
+  fi
+
+  if [ "${data_file##*.}" != "ncl" ]; then
+    echo "error: expected Nickel data file (*.ncl): $data_file"
+    exit 1
+  fi
+
+  local output_dir
+  output_dir=$(dirname "$output_file")
+  if [ ! -d "$output_dir" ]; then
+    echo "error: output directory does not exist: $output_dir"
+    exit 1
+  fi
+
+  nickel export --format text <<Nickel > "$output_file"
+let render = import "${script_dir}/template/Dockerfile.ncl" in
+let {Schema} = import "${script_dir}/template/schema.ncl" in
+let config = import "${data_file}" in
+render (config | Schema)
+Nickel
+
 }
+
 main "$@"
diff --git a/generator/.gitignore b/generator/.gitignore
deleted file mode 100644
index 857a4d7f..00000000
--- a/generator/.gitignore
+++ /dev/null
@@ -1,3 +0,0 @@
-/.stack-work
-
-/.idea
diff --git a/generator/CHANGELOG.md b/generator/CHANGELOG.md
deleted file mode 100644
index 94167225..00000000
--- a/generator/CHANGELOG.md
+++ /dev/null
@@ -1,5 +0,0 @@
-# Revision history for generator
-
-## 0.1.0.0 -- YYYY-mm-dd
-
-* First version. Released on an unsuspecting world.
diff --git a/generator/app/Main.hs b/generator/app/Main.hs
deleted file mode 100644
index caeee56f..00000000
--- a/generator/app/Main.hs
+++ /dev/null
@@ -1,113 +0,0 @@
-{-# LANGUAGE LambdaCase #-}
-{-# LANGUAGE OverloadedStrings #-}
-
--- | An example Ginger CLI application.
---
--- Takes two optional arguments; the first one is a template file, the second
--- one a file containing some context data in JSON format.
-module Main where
-
-import qualified Data.Aeson as JSON
-import qualified Data.ByteString as BS
-import qualified Data.ByteString.UTF8 as UTF8
-import Data.HashMap.Strict (HashMap)
-import qualified Data.HashMap.Strict as HashMap
-import Data.Text (Text)
-import qualified Data.Text as Text
-import qualified Data.Yaml as YAML hiding (decodeFile)
-import qualified Data.Yaml.Include as YAML (decodeFile)
-import Options (DataSource (..), Options (..), TemplateSource (..), parseOptions)
-import System.Environment (getArgs)
-import System.Exit
-import System.IO
-import System.IO.Error
-import Text.Ginger
-
-main :: IO ()
-main = do
-  args <- getArgs
-  options <- parseOptions args
-  case options of
-    RunOptions tpl dat ->
-      run tpl dat
-
-loadData :: DataSource -> IO (Maybe (HashMap Text JSON.Value))
-loadData (DataFromFile fn) = YAML.decodeFile fn
-loadData DataFromStdin = decodeStdin
-loadData (DataLiteral str) = decodeString str
-
-loadTemplate :: TemplateSource -> IO (Template SourcePos)
-loadTemplate tplSrc = do
-  let resolve = loadFileMay
-  (tpl, src) <- case tplSrc of
-    TemplateFromFile fn -> (,) <$> parseGingerFile resolve fn <*> return Nothing
-    TemplateFromStdin -> getContents >>= \s -> (,) <$> parseGinger resolve Nothing s <*> return (Just s)
-
-  case tpl of
-    Left err -> do
-      tplSource <-
-        case src of
-          Just s ->
-            return (Just s)
-          Nothing -> do
-            let s = sourceName <$> peSourcePosition err
-            case s of
-              Nothing -> return Nothing
-              Just sn -> Just <$> loadFile sn
-      printParserError tplSource err
-      exitFailure
-    Right t -> do
-      return t
-
-run :: TemplateSource -> DataSource -> IO ()
-run tplSrc dataSrc = do
-  scope <- loadData dataSrc
-  let contextLookup :: Text -> Run p IO Text (GVal (Run p IO Text))
-      contextLookup key = return $ toGVal (scope >>= HashMap.lookup key)
-  let context =
-        makeContextTextExM
-          contextLookup
-          (putStr . Text.unpack)
-          (hPutStrLn stderr . show)
-
-  tpl <- loadTemplate tplSrc
-  runGingerT context tpl >>= either (hPutStrLn stderr . show) showOutput
-  where
-    showOutput value
-      | isNull value = return ()
-      | otherwise = putStrLn . show $ value
-
-printParserError :: Maybe String -> ParserError -> IO ()
-printParserError srcMay = putStrLn . formatParserError srcMay
-
-displayParserError :: String -> ParserError -> IO ()
-displayParserError src pe = do
-  case peSourcePosition pe of
-    Just pos -> do
-      let ln = Prelude.take 1 . Prelude.drop (sourceLine pos - 1) . Prelude.lines $ src
-      case ln of
-        [] -> return ()
-        x : _ -> do
-          putStrLn x
-          putStrLn $ Prelude.replicate (sourceColumn pos - 1) ' ' ++ "^"
-    _ -> return ()
-
-loadFile :: FilePath -> IO String
-loadFile fn = openFile fn ReadMode >>= hGetContents
-
-loadFileMay :: FilePath -> IO (Maybe String)
-loadFileMay fn =
-  tryIOError (loadFile fn) >>= \case
-    Right contents -> return (Just contents)
-    Left err -> do
-      print err
-      return Nothing
-
-decodeString :: (JSON.FromJSON v) => String -> IO (Maybe v)
-decodeString = return . decodeYamlMaybe . UTF8.fromString
-
-decodeStdin :: (JSON.FromJSON v) => IO (Maybe v)
-decodeStdin = decodeYamlMaybe <$> BS.getContents
-
-decodeYamlMaybe :: (JSON.FromJSON v) => BS.ByteString -> Maybe v
-decodeYamlMaybe = either (const Nothing) Just . YAML.decodeEither'
diff --git a/generator/app/Options.hs b/generator/app/Options.hs
deleted file mode 100644
index 1669953e..00000000
--- a/generator/app/Options.hs
+++ /dev/null
@@ -1,69 +0,0 @@
-module Options
-where
-
-import Options.Applicative
-
-
-data TemplateSource
-  = TemplateFromFile FilePath
-  | TemplateFromStdin
-
-data DataSource
-  = DataFromFile FilePath
-  | DataLiteral String
-  | DataFromStdin
-
-data Options
-  = RunOptions TemplateSource DataSource
-
-parseOptions :: [String] -> IO Options
-parseOptions _args =
-  execParser $ info (options <**> helper)
-    ( fullDesc
-    <> header "ginger - A command-line interface for the Ginger template language"
-    )
-
-options :: Parser Options
-options = runOptions
-
-runOptions :: Parser Options
-runOptions =
-  RunOptions <$> templateSource <*> dataSource
-
-templateSource :: Parser TemplateSource
-templateSource =
-  convert <$> option str
-      ( long "template"
-      <> short 't'
-      <> metavar "TEMPLATE"
-      <> help "Load ginger template from this file"
-      <> value "-"
-      )
-  where
-    convert "-" = TemplateFromStdin
-    convert f = TemplateFromFile f
-
-dataSource :: Parser DataSource
-dataSource =
-  dataFromFile <|> dataLiteral
-
-dataFromFile :: Parser DataSource
-dataFromFile =
-  convert <$> option str
-        ( long "data-file"
-        <> metavar "DATAFILE"
-        <> help "Load JSON or YAML data from this file (`-' to read from stdin)"
-        )
-  where
-    convert "-" = DataFromStdin
-    convert f = DataFromFile f
-
-dataLiteral :: Parser DataSource
-dataLiteral =
-  DataLiteral <$> option str
-        ( long "data"
-        <> short 'd'
-        <> metavar "DATA"
-        <> help "Use specified (JSON or YAML) DATA"
-        <> value "{}"
-        )
diff --git a/generator/generator.cabal b/generator/generator.cabal
deleted file mode 100644
index a2117cd9..00000000
--- a/generator/generator.cabal
+++ /dev/null
@@ -1,84 +0,0 @@
-cabal-version:      3.8
--- The cabal-version field refers to the version of the .cabal specification,
--- and can be different from the cabal-install (the tool) version and the
--- Cabal (the library) version you are using. As such, the Cabal (the library)
--- version used must be equal or greater than the version stated in this field.
--- Starting from the specification version 2.2, the cabal-version field must be
--- the first thing in the cabal file.
-
--- Initial package description 'generator' generated by
--- 'cabal init'. For further documentation, see:
---   http://haskell.org/cabal/users-guide/
---
--- The name of the package.
-name:               generator
-
--- The package version.
--- See the Haskell package versioning policy (PVP) for standards
--- guiding when and how versions should be incremented.
--- https://pvp.haskell.org
--- PVP summary:     +-+------- breaking API changes
---                  | | +----- non-breaking API additions
---                  | | | +--- code changes with no API change
-version:            0.1.0.0
-
--- A short (one-line) description of the package.
--- synopsis:
-
--- A longer description of the package.
--- description:
-
--- The license under which the package is released.
-license:            NONE
-
--- The package author(s).
-author:             Andrei Dziahel
-
--- An email address to which users can send suggestions, bug reports, and patches.
-maintainer:         develop7@develop7.info
-
--- A copyright notice.
--- copyright:
-build-type:         Simple
-
--- Extra doc files to be distributed with the package, such as a CHANGELOG or a README.
-extra-doc-files:    CHANGELOG.md
-
--- Extra source files to be distributed with the package, such as examples, or a tutorial module.
--- extra-source-files:
-
-common warnings
-    ghc-options: -Wall
-
-executable generator
-    -- Import common warning flags.
-    import:           warnings
-
-    -- .hs or .lhs file containing the Main module.
-    main-is:          Main.hs
-
-    -- Modules included in this executable, other than Main.
-    other-modules:    Options
-
-    -- LANGUAGE extensions used by modules in this package.
-    -- other-extensions:
-
-    -- Other library packages from which modules are imported.
-    build-depends:    base
-                    , aeson
-                    , bytestring
-                    , data-default
-                    , ginger
-                    , optparse-applicative
-                    , text
-                    , process
-                    , transformers
-                    , unordered-containers
-                    , utf8-string
-                    , yaml
-
-    -- Directories containing source files.
-    hs-source-dirs:   app
-
-    -- Base language which the package is written in.
-    default-language: Haskell2010
diff --git a/generator/hie.yaml b/generator/hie.yaml
deleted file mode 100644
index 4ef275e0..00000000
--- a/generator/hie.yaml
+++ /dev/null
@@ -1,2 +0,0 @@
-cradle:
-  stack:
diff --git a/generator/stack.yaml b/generator/stack.yaml
deleted file mode 100644
index 06dbcc2e..00000000
--- a/generator/stack.yaml
+++ /dev/null
@@ -1,68 +0,0 @@
-# This file was automatically generated by 'stack init'
-#
-# Some commonly used options have been documented as comments in this file.
-# For advanced use and comprehensive documentation of the format, please see:
-# https://docs.haskellstack.org/en/stable/configure/yaml/
-
-# A 'specific' Stackage snapshot or a compiler version.
-# A snapshot resolver dictates the compiler version and the set of packages
-# to be used for project dependencies. For example:
-#
-# snapshot: lts-23.14
-# snapshot: nightly-2025-02-15
-# snapshot: ghc-9.8.4
-#
-# The location of a snapshot can be provided as a file or url. Stack assumes
-# a snapshot provided as a file might change, whereas a url resource does not.
-#
-# snapshot: ./custom-snapshot.yaml
-# snapshot: https://example.com/snapshots/2024-01-01.yaml
-resolver: lts-24.36
-
-# User packages to be built.
-# Various formats can be used as shown in the example below.
-#
-# packages:
-# - some-directory
-# - https://example.com/foo/bar/baz-0.0.2.tar.gz
-#   subdirs:
-#   - auto-update
-#   - wai
-packages:
-- .
-# Dependency packages to be pulled from upstream that are not in the snapshot.
-# These entries can reference officially published versions as well as
-# forks / in-progress versions pinned to a git hash. For example:
-#
-# extra-deps:
-# - acme-missiles-0.3
-# - git: https://github.com/commercialhaskell/stack.git
-#   commit: e7b331f14bcffb8367cd58fbfc8b40ec7642100a
-#
-# extra-deps: []
-#extra-deps:
-#  - ginger-0.10.6.0
-
-# Override default flag values for project packages and extra-deps
-# flags: {}
-
-# Extra package databases containing global packages
-# extra-package-dbs: []
-
-# Control whether we use the GHC we find on the path
-# system-ghc: true
-#
-# Require a specific version of Stack, using version ranges
-# require-stack-version: -any # Default
-# require-stack-version: ">=3.5"
-#
-# Override the architecture used by Stack, especially useful on Windows
-# arch: i386
-# arch: x86_64
-#
-# Extra directories used by Stack for building
-# extra-include-dirs: [/path/to/dir]
-# extra-lib-dirs: [/path/to/dir]
-#
-# Allow a newer minor version of GHC than the snapshot specifies
-# compiler-check: newer-minor
diff --git a/generator/stack.yaml.lock b/generator/stack.yaml.lock
deleted file mode 100644
index 7f9c4e2e..00000000
--- a/generator/stack.yaml.lock
+++ /dev/null
@@ -1,12 +0,0 @@
-# This file was autogenerated by Stack.
-# You should not edit this file by hand.
-# For more information, please see the documentation at:
-#   https://docs.haskellstack.org/en/stable/topics/lock_files
-
-packages: []
-snapshots:
-- completed:
-    sha256: a6882445afe04fd38791656e3667b491d92b9c27bcf18cda7e01c73016e828ee
-    size: 728959
-    url: https://raw.githubusercontent.com/commercialhaskell/stackage-snapshots/master/lts/24/36.yaml
-  original: lts-24.36
diff --git a/template/Dockerfile.jinja b/template/Dockerfile.ncl
similarity index 78%
rename from template/Dockerfile.jinja
rename to template/Dockerfile.ncl
index f3e5003a..7a479c76 100644
--- a/template/Dockerfile.jinja
+++ b/template/Dockerfile.ncl
@@ -1,4 +1,17 @@
-FROM {{ distro.image }}
+let render =
+  fun cfg =>
+    let distro = cfg.distro in
+    let stack = cfg.stack in
+    let cabal_install = cfg.cabal_install in
+    let ghc = cfg.ghc in
+    let ghc_override_line =
+      if std.record.has_field "url" ghc.assets.aarch64 then
+        "            GHC_URL='%{ghc.assets.aarch64.url}'; " ++ "\\" ++ "\n"
+      else
+        ""
+    in
+      m%"
+FROM %{distro.image}
 
 ENV LANG=C.UTF-8
 
@@ -24,8 +37,8 @@ RUN apt-get update && \
     rm -rf /var/lib/apt/lists/*
 
 
-ARG STACK='{{ _globals.stack.version }}'
-ARG STACK_RELEASE_KEY='{{ _globals.stack.release_key }}'
+ARG STACK='%{stack.version}'
+ARG STACK_RELEASE_KEY='%{stack.release_key}'
 
 RUN set -eux; \
     cd /tmp; \
@@ -34,10 +47,10 @@ RUN set -eux; \
     # sha256 from https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz.sha256 \
     case "$ARCH" in \
         'aarch64') \
-            STACK_SHA256='{{ _globals.stack.sha256sum.aarch64 }}'; \
+            STACK_SHA256='%{stack.assets.aarch64.sha256sum}'; \
             ;; \
         'x86_64') \
-            STACK_SHA256='{{ _globals.stack.sha256sum.x86_64 }}'; \
+            STACK_SHA256='%{stack.assets.x86_64.sha256sum}'; \
             ;; \
         *) echo >&2 "error: unsupported architecture '$ARCH'"; exit 1 ;; \
     esac; \
@@ -59,22 +72,22 @@ RUN set -eux; \
     \
     stack --version;
 
-ARG CABAL_INSTALL='{{ _globals.cabal_install.version }}'
-ARG CABAL_INSTALL_RELEASE_KEY='{{ _globals.cabal_install.release_key }}'
+ARG CABAL_INSTALL='%{cabal_install.version}'
+ARG CABAL_INSTALL_RELEASE_KEY='%{cabal_install.release_key}'
 
 RUN set -eux; \
     cd /tmp; \
     ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"; \
-    CABAL_INSTALL_TAR="cabal-install-$CABAL_INSTALL-$ARCH-linux-{{ distro.abbr }}.tar.xz"; \
+    CABAL_INSTALL_TAR="cabal-install-$CABAL_INSTALL-$ARCH-linux-%{distro.abbr}.tar.xz"; \
     CABAL_INSTALL_URL="https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/$CABAL_INSTALL_TAR"; \
     CABAL_INSTALL_SHA256SUMS_URL="https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/SHA256SUMS"; \
     # sha256 from https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/SHA256SUMS \
     case "$ARCH" in \
         'aarch64') \
-            CABAL_INSTALL_SHA256='{{ cabal_install.sha256sum.aarch64 }}'; \
+            CABAL_INSTALL_SHA256='%{cabal_install.assets.aarch64.sha256sum}'; \
             ;; \
         'x86_64') \
-            CABAL_INSTALL_SHA256='{{ cabal_install.sha256sum.x86_64 }}'; \
+            CABAL_INSTALL_SHA256='%{cabal_install.assets.x86_64.sha256sum}'; \
             ;; \
         *) echo >&2 "error: unsupported architecture '$ARCH'"; exit 1 ;; \
     esac; \
@@ -96,23 +109,20 @@ RUN set -eux; \
     \
     cabal --version
 
-ARG GHC='{{ ghc.version }}'
-ARG GHC_RELEASE_KEY='{{ ghc.release_key }}'
+ARG GHC='%{ghc.version}'
+ARG GHC_RELEASE_KEY='%{ghc.release_key}'
 
 RUN set -eux; \
     cd /tmp; \
     ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"; \
-    GHC_URL="https://downloads.haskell.org/~ghc/$GHC/ghc-$GHC-$ARCH-{{ distro.abbr }}-linux.tar.xz"; \
+    GHC_URL="https://downloads.haskell.org/~ghc/$GHC/ghc-$GHC-$ARCH-%{distro.abbr}-linux.tar.xz"; \
     # sha256 from https://downloads.haskell.org/~ghc/$GHC/SHA256SUMS \
     case "$ARCH" in \
         'aarch64') \
-            GHC_SHA256='{{ ghc.sha256sum.aarch64 }}'; \
-{% if overrides.ghc.aarch64.url %}
-            GHC_URL='{{ overrides.ghc.aarch64.url }}'; \
-{% endif %}
-            ;; \
+            GHC_SHA256='%{ghc.assets.aarch64.sha256sum}'; \
+%{ghc_override_line}            ;; \
         'x86_64') \
-            GHC_SHA256='{{ ghc.sha256sum.x86_64 }}'; \
+            GHC_SHA256='%{ghc.assets.x86_64.sha256sum}'; \
             ;; \
         *) echo >&2 "error: unsupported architecture '$ARCH'" ; exit 1 ;; \
     esac; \
@@ -137,3 +147,6 @@ RUN set -eux; \
 ENV PATH=/root/.cabal/bin:/root/.local/bin:/opt/ghc/${GHC}/bin:$PATH
 
 CMD ["ghci"]
+"%
+in
+  render
diff --git a/template/schema.ncl b/template/schema.ncl
new file mode 100644
index 00000000..47ab6fdb
--- /dev/null
+++ b/template/schema.ncl
@@ -0,0 +1,93 @@
+let RecordWithOnlyKeys = fun keys map_contract =>
+  std.contract.custom (fun label value =>
+    std.contract.check map_contract label value
+    |> match {
+      'Error err => 'Error err,
+      'Ok checked_value =>
+        let value_fields = std.record.fields checked_value in
+        value_fields
+        |> std.array.fold_right
+          (fun field_name rest =>
+            if std.array.elem field_name keys then
+              rest
+            else
+              'Error { message = "extra field `%{field_name}`" }
+          )
+          (
+            keys
+            |> std.array.fold_right
+              (fun field_name rest =>
+                if std.array.elem field_name value_fields then
+                  rest
+                else
+                  'Error { message = "missing field `%{field_name}`" }
+              )
+              ('Ok checked_value)
+          ),
+    }
+  )
+in
+
+let Asset = {
+  sha256sum
+    | String
+    | doc "Asset SHA256",
+  url
+    | String
+    | optional
+    | doc "Asset URL",
+}
+in
+
+let ArchAssets = RecordWithOnlyKeys ["aarch64", "x86_64"] { _ : Asset }
+in
+{
+  Schema = {
+    distro
+      | {
+        codename
+          | String
+          | doc "Distribution code name, e.g. trixie or bookworm",
+        abbr
+          | String
+          | doc "Distribution abbreviation, used on https://downloads.haskell.org/",
+        image
+          | String
+          | doc "Docker image identifier",
+      },
+    ghc
+      | {
+        version
+          | String
+          | doc "GHC version number",
+        release_key
+          | String
+          | doc "GPG release key release is signed with via <archive_name>.sig",
+        assets
+          | ArchAssets,
+      },
+    cabal_install
+      | {
+        version
+          | String
+          | doc "cabal_install version number",
+        release_key
+          | String
+          | doc "GPG release key release is signed with via <archive_name>.sig",
+        assets
+          | ArchAssets,
+      },
+    stack
+      | {
+        version
+          | String
+          | doc "Stack version number",
+        release_key
+          | String
+          | doc "GPG release key release is signed with via <archive_name>.sig",
+        assets
+          | ArchAssets
+          | doc "Stack binary distribution assets",
+      },
+  },
+}