{
  description = "A naersk based rust flake";

  inputs = {
    utils.url = "github:numtide/flake-utils";
    naersk = {
      url = "github:nmattia/naersk";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    # fenix.url = "github:nix-community/fenix";
  };

  outputs = inputs @ { self, nixpkgs, utils, naersk, ... }:
    let
      root = inputs.source or self;
      pname = "ssh-cert-dist";
      # toolchains: stable, beta, default(nightly)
      toolchain = pkgs:
        if inputs ? fenix then inputs.fenix.packages."${pkgs.system}".complete.toolchain
        else with pkgs; symlinkJoin { name = "rust-toolchain"; paths = [ rustc cargo ]; };
      forSystem = system:
        let
          pkgs = nixpkgs.legacyPackages."${system}";
        in
        rec {
          # `nix build`
          packages."${pname}-server" = (self.overlay pkgs pkgs)."${pname}-server";
          packages."${pname}-client" = (self.overlay pkgs pkgs)."${pname}-client";

          packages."${pname}-client-snap" = pkgs.snapTools.makeSnap {
            meta = {
              name = pname;
              architectures = [ "amd64" ];
              confinement = "strict";
              apps.hello.command = apps."${pname}-client".program;
            };
          };

          packages.dockerImage = pkgs.runCommandLocal "docker-${pname}.tar.gz" { } "${apps.streamDockerImage.program} | gzip --fast > $out";

          packages.default = packages."${pname}-client";

          # `nix run`
          apps."${pname}-server" = utils.lib.mkApp {
            drv = packages."${pname}-server";
            exePath = "/bin/sshcd-server";
          };
          apps."${pname}-client" = utils.lib.mkApp {
            drv = packages."${pname}-client";
            exePath = "/bin/sshcd";
          };

          # `nix run .#streamDockerImage | docker load`
          apps.streamDockerImage = utils.lib.mkApp {
            drv = with pkgs; dockerTools.streamLayeredImage {
              name = pname;
              tag = self.shortRev or "latest";
              config = {
                Entrypoint = apps."${pname}-server".program;
              };
            };
            exePath = "";
          };
          apps.default = apps."${pname}-client";

          # `nix flake check`
          checks = {
            fmt = with pkgs; runCommandLocal "${pname}-fmt" { buildInputs = [ cargo rustfmt nixpkgs-fmt ]; } ''
              cd ${root}
              cargo fmt -- --check
              nixpkgs-fmt --check *.nix
              touch $out
            '';
          };

          hydraJobs = checks // packages;

          # `nix develop`
          devShell = pkgs.mkShell rec {
            RUST_SRC_PATH = "${if inputs ? fenix then "${toolchain pkgs}/lib/rustlib" else pkgs.rustPlatform.rustLibSrc}";
            RUST_LOG = "debug";

            SSH_CD_SOCKET_ADDRESS = "127.0.0.1:6869";
            SSH_CD_CERT_DIR = "certs/";
            SSH_CD_CA = "certs/ca.pub";

            SSH_CD_API = "http://${SSH_CD_SOCKET_ADDRESS}";

            nativeBuildInputs = with pkgs; [ (toolchain pkgs) cargo-watch rustfmt nixpkgs-fmt ] ++ packages.default.nativeBuildInputs;
            inherit (packages.default) buildInputs;
            shellHook = ''
              printf "Rust version:"
              rustc --version
              printf "\nbuild inputs: ${pkgs.lib.concatStringsSep ", " (map (bi: bi.name) (buildInputs ++ nativeBuildInputs))}"
              function server() {
                if [ ! -e "certs/ca.pub" ]; then
                  mkdir -p certs keys
                  ssh-keygen -t ed25519 -f certs/ca -q -N ""
                  ssh-keygen -t ed25519 -f keys/host -q -N ""
                  ssh-keygen -t ed25519 -f keys/client -q -N ""
                  ssh-keygen -s certs/ca -V +1000d -h -I host -n localhost,127.0.0.1 -h keys/host.pub
                  ssh-keygen -s certs/ca -V +1000d -I client -n "client,client@localhost" keys/client.pub -O force-command="echo Hello World"
                fi
                cargo watch -x "run --bin sshcd-server --all-features -- ''${@}" 
              }
            '';
          };

        };
    in
    (utils.lib.eachDefaultSystem forSystem) // {
      overlays.pinned = final: prev: (self.overlay final (import nixpkgs {
        inherit (final) localSystem;
      })).packages;
      overlay = final: prev:
        let
          naersk-lib = naersk.lib."${final.system}".override {
            rustc = toolchain prev;
            cargo = toolchain prev;
          };
          buildInputs = with prev; [
            openssl
          ];
          nativeBuildInputs = with prev; [
            pkg-config
          ];
        in
        {
          "${pname}-server" =
            naersk-lib.buildPackage {
              name = "${pname}-server";
              inherit root buildInputs nativeBuildInputs;
            };
          "${pname}-client" =
            naersk-lib.buildPackage {
              name = "${pname}-client";
              inherit root buildInputs nativeBuildInputs;
            };
        };

      nixosModules.default = {
        imports = [ ./modules/nixos.nix ];
      };
      homeManagerModules.default = {
        imports = [ ./modules/home-manager.nix ];
      };
      nixosConfigurations.test = nixpkgs.lib.nixosSystem {
        system = "x86_64-linux";
        modules = [
          self.nixosModules.default
        ];
      };

    };

}