{
  description = "nix-ota — open-source OTA updates for NixOS fleets";

  inputs = {
    nixpkgs.url = "github:nixos/nixpkgs?ref=nixos-unstable";
  };

  outputs = { self, nixpkgs }:
    let
      systems = [ "x86_64-linux" "aarch64-linux" ];
      forAllSystems = f: nixpkgs.lib.genAttrs systems (system: f system nixpkgs.legacyPackages.${system});

      mkPkg = pkgs: pname:
        let
          subdir = {
            "nix-ota-server"    = "server";
            "nix-ota-agent"     = "agent";
            "nix-ota-publisher" = "publisher";
          }.${pname};
        in pkgs.rustPlatform.buildRustPackage {
          inherit pname;
          version = "0.1.0";
          src = ./.;
          cargoLock.lockFile = ./Cargo.lock;
          buildAndTestSubdir = "crates/${subdir}";
          nativeBuildInputs = with pkgs; [ pkg-config ];
          buildInputs = with pkgs; [ openssl ];
          doCheck = false;
          meta.license = pkgs.lib.licenses.mit;
        };
    in {
      packages = forAllSystems (system: pkgs: {
        nix-ota-server    = mkPkg pkgs "nix-ota-server";
        nix-ota-agent     = mkPkg pkgs "nix-ota-agent";
        nix-ota-publisher = mkPkg pkgs "nix-ota-publisher";
        default           = self.packages.${system}.nix-ota-server;
      });

      apps = forAllSystems (system: pkgs: {
        server = {
          type = "app";
          program = "${self.packages.${system}.nix-ota-server}/bin/nix-ota-server";
        };
        agent = {
          type = "app";
          program = "${self.packages.${system}.nix-ota-agent}/bin/nix-ota-agent";
        };
        nix-ota = {
          type = "app";
          program = "${self.packages.${system}.nix-ota-publisher}/bin/nix-ota";
        };
        default = self.apps.${system}.server;
      });

      nixosModules = {
        server = import ./nix/modules/server.nix self;
        agent  = import ./nix/modules/agent.nix  self;
      };

      devShells = forAllSystems (system: pkgs: {
        default = pkgs.mkShell {
          packages = with pkgs; [ cargo rustc rustfmt clippy pkg-config openssl sqlite ];
        };
      });

      checks = forAllSystems (system: pkgs: {
        vm = import ./nix/tests/ota.nix { inherit pkgs self system; };
      });
    };
}