{
  inputs = {
    nixpkgs.url = "github:nixos/nixpkgs/nixos-25.11";
    flake-utils.url = "github:numtide/flake-utils/main";

    rust-overlay = {
      url = "github:oxalica/rust-overlay/master";
      inputs.nixpkgs.follows = "nixpkgs";
    };

    crane.url = "github:ipetkov/crane";
  };

  description = "thulani discord bot";

  outputs = {
    self,
    nixpkgs,
    flake-utils,
    ...
  } @ inputs: let
    inherit (nixpkgs) lib;
    mkBuildToolchain = pkgs: pkgs.rust-bin.nightly."2025-12-01".minimal;

    rustsrc = let
      filter = with lib.fileset; unions [
        (maybeMissing ./.cargo/config.toml)
        ./README.md
        ./Cargo.lock
        (fileFilter (file: file.hasExt "rs") ./.)
        (fileFilter (file: file.hasExt "sql") ./.)
        (fileFilter (file: file.hasExt "pest") ./.)
        (fileFilter (file: file.name == "Cargo.toml") ./.)
      ];
    in lib.fileset.toSource {
      root = ./.;
      fileset = filter;
    };

    deps = pkgs: with pkgs; [
      openssl
      pkg-config
      libopus
      postgresql
    ];

    mkPkg = pkgs: let
      buildToolchain = mkBuildToolchain pkgs;
      crane = (inputs.crane.mkLib pkgs).overrideToolchain mkBuildToolchain;

      inherit (pkgs) lib;

    in pkgs.callPackage ./nix/package.nix {
      inherit crane rustsrc;
    };

  in (flake-utils.lib.eachDefaultSystem (system:
    let
      pkgs = import nixpkgs {
        inherit system;

        overlays = [
          (import inputs.rust-overlay)
        ];
      };

      dbInit = (pkgs.writeShellScript "thulani-dbinit" (builtins.readFile ./nix/dbinit.sh)).overrideAttrs (final: prev: {
        checkPhase = ''
          ${pkgs.shellcheck}/bin/shellcheck $out
        '';
      });

      devToolchain = (mkBuildToolchain pkgs).override {
        extensions = [
          "rust-src"
          "rust-analyzer"
          "clippy"
          "rust-docs"
          "rustfmt"
        ];
      };

      pkg = mkPkg pkgs;

    in {
      devShells.default = pkgs.mkShell {
        buildInputs = (with pkgs; [
          devToolchain
          shellcheck
        ]) ++ (deps pkgs);

        RUST_SRC_PATH = "${devToolchain}/lib/rustlib/src/rust";
      };

      packages = {
        default = pkg;
        inherit dbInit;
      };

      apps.default = {
        type = "app";
        program = "${pkg}/bin/thulani";
      };
    }) // {
      hydraJobs = {
        inherit (self.packages) x86_64-linux;
      };

      overlays.default = final: prev: let
        withRust = ((import inputs.rust-overlay) final prev);
      in withRust // {
        thulani = mkPkg (final // withRust);
      };

      nixosConfigurations.test = nixpkgs.lib.nixosSystem {
        system = "x86_64-linux";

        modules = [
          self.nixosModules.default
          "${nixpkgs}/nixos/modules/virtualisation/qemu-vm.nix"

          ({ config, lib, pkgs, ... }: {
            nixpkgs.overlays = [
              self.overlays.default
            ];

            environment.systemPackages = with pkgs; [
              (writeShellScriptBin "jl" ''
                journalctl -eu thulani | cat
              '')

              (writeShellScriptBin "s" ''
                exec systemctl status thulani $@
              '')
            ];

            users = {
              mutableUsers = false;

              users.root.hashedPassword = lib.mkForce "";

              users.test = {
                password = lib.mkForce "test";
                group = "test";
                isNormalUser = true;
                extraGroups = [
                  "wheel"
                  "sudo"
                ];
              };

              groups.test = {};
            };

            security.sudo.wheelNeedsPassword = false;

            virtualisation = {
              cores = 8;
              graphics = false;
              diskSize = 32*1024;
              memorySize = 12*1024;
              writableStoreUseTmpfs = false;
            };

            services.thulani = {
              enable = true;

              environment = {
                STEAM_API_KEY = "";
                SHEETS_API_KEY = "";
                SPREADSHEET_ID = "";
                THULANI_CLIENT_ID = "1";
                THULANI_TOKEN = "";
                VOICE_CHANNEL = "1";
                OWNER_ID = "1";
                TARGET_GUILD = "1";
              };

              postgres = {
                enable = true;
              };
            };
          })
        ];
      };

      nixosModules.default = import ./nix/module.nix self;
    }
  );
}