{
  description = "Decrypt your LUKS partition using a FIDO2 compatible authenticator";

  inputs = {
    utils.url = "github:numtide/flake-utils";
    cargo-deb = {
      flake = false;
      url = "github:mmstick/cargo-deb";
    };
    naersk = {
      url = "github:nmattia/naersk";
      inputs.nixpkgs.follows = "nixpkgs";
    };
  };

  outputs = { self, nixpkgs, utils, naersk, cargo-deb }:
    let
      root = ./.;
      pname = (builtins.fromTOML (builtins.readFile ./Cargo.toml)).package.name;
      forPkgs = pkgs:
        let
          naersk-lib = naersk.lib."${pkgs.system}";
          buildInputs = with pkgs; [ cryptsetup ];
          LIBCLANG_PATH = "${pkgs.clang.cc.lib}/lib";
          nativeBuildInputs = with pkgs; [
            pkgconfig
            clang
          ];
        in
        rec {
          # `nix build`
          packages.${pname} = naersk-lib.buildPackage {
            inherit pname root buildInputs nativeBuildInputs LIBCLANG_PATH;
          };

          packages."${pname}-deb" =
            let
              cargoDeb = naersk-lib.buildPackage {
                pname = "cargo-deb";
                root = cargo-deb;
              };
              pkg = packages.${pname};
              vm = pkgs.vmTools.diskImageFuns.ubuntu1804x86_64 { extraPackages = [ "cargo" "cryptsetup" "libclang-dev" "libcryptsetup-dev" ]; };
              makefile = pkgs.writeText "Makefile" "
                .PHONY: install

                cargo-deb:
                        cargo install --debug --path cargo-deb

                install: cargo-deb
                        cargo-deb
                        mkdir -p debs
                        cp target/debian/*.deb debs/
                  
              ";
              src = pkgs.runCommandLocal "${pname}-vendored" {} ''
                mkdir -p $out/.cargo $out/cargo-deb/.cargo
                printf '${pkg.cargoconfig}' > $out/.cargo/config.toml; 
                printf '${cargoDeb.cargoconfig}' > $out/cargo-deb/.cargo/config.toml;
                printf '.PHONY: install\ninstall:\n\tcargo install --debug --path cargo-deb\n\tcargo-deb\n\tmkdir -p debs\n\tcp target/debian/*.deb debs/' > $out/Makefile
                cp -r ${pkg.src}/. $out/
                cp -r ${cargoDeb.src}/. $out/cargo-deb/
              '';
              args = {
                diskImage = vm;
                inherit src;
                name = pname;
                buildInputs = [ ];
                meta.description = "No descr";
              };
            in
            pkgs.releaseTools.debBuild args;

          defaultPackage = packages.${pname};

          # `nix run`
          apps.${pname} = utils.lib.mkApp {
            drv = packages.${pname};
          };
          defaultApp = apps.${pname};

          # `nix flake check`
          checks = {
            fmt = with pkgs; runCommandLocal "${pname}-fmt" { buildInputs = [ cargo rustfmt nixpkgs-fmt ]; } ''
              cd ${root}
              cargo fmt -- --check
              nixpkgs-fmt --check *.nix
              touch $out
            '';
          };

          hydraJobs = checks // packages;

          # `nix develop`
          devShell = pkgs.mkShell {
            nativeBuildInputs = with pkgs; [ rustc cargo rustfmt nixpkgs-fmt ] ++ nativeBuildInputs;
            inherit buildInputs LIBCLANG_PATH;
          };
        };
      forSystem = system: forPkgs nixpkgs.legacyPackages."${system}";
    in
    (utils.lib.eachSystem [ "aarch64-linux" "i686-linux" "x86_64-linux" ] forSystem) // {
      overlay = final: prev: (forPkgs final).packages;
    };

}