{
  description = "A naersk based rust flake";

  inputs = {
    utils.url = "github:numtide/flake-utils";
    naersk = {
      url = "github:nmattia/naersk";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    # fenix.url = "github:nix-community/fenix";
  };

  outputs = inputs @ { self, nixpkgs, utils, naersk, ... }:
    let
      root = inputs.source or self;
      pname = (builtins.fromTOML (builtins.readFile (root + "/Cargo.toml"))).package.name;
      # toolchains: stable, beta, default(nightly)
      toolchain = pkgs:
        if inputs ? fenix then inputs.fenix.packages."${pkgs.system}".complete.toolchain
        else with pkgs; symlinkJoin { name = "rust-toolchain"; paths = [ rustc cargo ]; };
      forSystem = system:
        let
          pkgs = nixpkgs.legacyPackages."${system}";
        in
        rec {
          # `nix build`
          packages.${pname} = (self.overlay pkgs pkgs).${pname};

          packages.dockerImage = pkgs.runCommandLocal "docker-${pname}.tar.gz" { } "${apps.streamDockerImage.program} | gzip --fast > $out";

          packages.default = packages.${pname};

          # `nix run`
          apps.${pname} = utils.lib.mkApp {
            drv = packages.${pname};
          };

          # `nix run .#streamDockerImage | docker load`
          apps.streamDockerImage = utils.lib.mkApp {
            drv = with pkgs; dockerTools.streamLayeredImage {
              name = pname;
              tag = self.shortRev or "latest";
              config = {
                Entrypoint = apps.default.program;
              };
            };
            exePath = "";
          };
          apps.default = apps.${pname};

          # `nix flake check`
          checks = {
            fmt = with pkgs; runCommandLocal "${pname}-fmt" { buildInputs = [ cargo rustfmt nixpkgs-fmt ]; } ''
              cd ${root}
              cargo fmt -- --check
              nixpkgs-fmt --check *.nix
              touch $out
            '';
          };

          hydraJobs = checks // packages;

          # `nix develop`
          devShell = pkgs.mkShell rec {
            RUST_SRC_PATH = "${if inputs ? fenix then "${toolchain pkgs}/lib/rustlib" else pkgs.rustPlatform.rustLibSrc}";
            RUST_LOG = "debug";
            nativeBuildInputs = with pkgs; [ (toolchain pkgs) cargo-watch rustfmt nixpkgs-fmt ] ++ packages.default.nativeBuildInputs;
            inherit (packages.default) buildInputs;
            shellHook = ''
              printf "Rust version:"
              rustc --version
              printf "\nbuild inputs: ${pkgs.lib.concatStringsSep ", " (map (bi: bi.name) (buildInputs ++ nativeBuildInputs))}"
            '';
          };

        };
    in
    (utils.lib.eachDefaultSystem forSystem) // {
      overlays.pinned = final: prev: (self.overlay final (import nixpkgs {
        inherit (final) localSystem;
      })).packages;
      overlay = final: prev:
        let
          naersk-lib = naersk.lib."${final.system}".override {
            rustc = toolchain prev;
            cargo = toolchain prev;
          };
          buildInputs = with prev; [
            openssl
          ];
          nativeBuildInputs = with prev; [
            pkg-config
          ];
        in
        {
          "${pname}" =
            naersk-lib.buildPackage {
              inherit pname root buildInputs nativeBuildInputs;
            };
        };

      nixosModules.default = { config, pkgs, lib, ... }: with lib; let cfg = config.services.ssh-cert-dist; in {
        options.services.ssh-cert-dist = {
          enable = mkEnableOption "ssh-cert-dist";
          host = mkOption {
            type = types.str;
            default = "127.0.0.1";
          };
          port = mkOption {
            type = types.port;
            default = 6877;
          };
          package = mkOption {
            type = types.package;
            default = pkgs.ssh-cert-dist;
          };
          dataDir = mkOption {
            type = types.path;
            default = "/var/lib/ssh-cert-dist";
          };
          user = mkOption {
            type = types.str;
            default = "cert-dist";
          };
          group = mkOption {
            type = types.str;
            default = "cert-dist";
          };
        };
        config = mkIf {
          users = {
            users.${cfg.user} = {
              isSystemUser = true;
              group = cfg.group;
            };
            groups.${cfg.group} = { };

          };
          systemd.services.ssh-cert-dist = {
            preStart = ''
              chown ${cfg.user}:${cfg.group} ${cfg.dataDir}
            '';
            serviceConfig.User = cfg.user;
            serviceConfig.ExecStart = "${cfg.package}/bin/ssh-cert-dist server --address ${cfg.host}:${toString cfg.port} -c ${cfg.dataDir} --ca ${cfg.ca}";
          };
        };
      };
      homeManagerModules.default = { config, pkgs, lib, ... }: with lib; let cfg = config.services.ssh-cert-dist; in { };

    };

}