{
  nixConfig = {
    trusted-substituters = "https://cache.nixos.org/";
    trusted-public-keys = "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=";
    extra-experimental-features = "nix-command flakes";
  };
  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-23.11";
    flake-utils.url = "github:numtide/flake-utils";
    geoip2-tarball = {
      url = "https://dl.jakstys.lt/_/2024.01.13.tar.zst";
      flake = false;
    };

    flake-compat.url = "github:nix-community/flake-compat";
    gitignore.url = "github:hercules-ci/gitignore.nix";
    gitignore.inputs.nixpkgs.follows = "nixpkgs";

    pre-commit-hooks = {
      url = "github:cachix/pre-commit-hooks.nix";
      inputs = {
        nixpkgs.follows = "nixpkgs";
        nixpkgs-stable.follows = "nixpkgs";
        flake-compat.follows = "flake-compat";
        flake-utils.follows = "flake-utils";
        gitignore.follows = "gitignore";
      };
    };
  };
  outputs = {
    self,
    nixpkgs,
    flake-utils,
    pre-commit-hooks,
    geoip2-tarball,
    ...
  }:
    flake-utils.lib.eachDefaultSystem (system: let
      pkgs = import ./pkgs.nix {
        inherit nixpkgs system geoip2-tarball;
      };
    in {
      packages = {
        inherit (pkgs) geoip-mmdb;
        inherit (pkgs) e11sync-static;
        inherit (pkgs) e11sync-frontend;
        inherit (pkgs) e11sync-backend;
      };

      checks = {
        e11sync-unit = pkgs.e11sync-backend.passthru.tests.unit;
        pre-commit-check = pre-commit-hooks.lib.${system}.run {
          src = ./.;
          hooks = {
            alejandra.enable = true;
            deadnix.enable = true;
            statix.enable = true;
          };
        };
        format = pkgs.runCommand "check-format" {} ''
          ${pkgs.python3Packages.flake8}/bin/flake8 \
              --exclude ${./.}/app/signup/migrations/ ${./.}/app
          mkdir -p $out
        '';
      };

      apps = {
        e11sync-frontend = {
          type = "app";
          name = "e11sync-frontend";
          program = toString (pkgs.writeShellScript "wrapper" ''
            exec ${pkgs.caddy}/bin/caddy run --config ${pkgs.writeTextFile {
              name = "Caddyfile";
              text = ''
                {
                  http_port 8001
                  auto_https off
                  debug
                }
                :8001
                ${builtins.readFile "${pkgs.e11sync-frontend}"}
              '';
            }} --adapter caddyfile'');
        };
        e11sync-backend = {
          type = "app";
          name = "e11sync-backend";
          program = toString (pkgs.writeShellScript "wrapper" ''
            export E11SYNC_DATABASE_PATH=$PWD/db.sqlite3
            exec ${pkgs.e11sync-backend}/bin/e11sync-backend
          '');
        };
      };

      devShells.default = pkgs.mkShellNoCC {
        packages = with pkgs; [
          (python3.withPackages
            (ps: [
              ps.django
              ps.django-compressor
              ps.geoip2

              ps.django-debug-toolbar
              ps.flake8
              # TODO: vim integration via EXITINT? See make check
              ps.autopep8
            ]))
          libmaxminddb
          dart-sass
        ];
        GEOIP_PATH = "${pkgs.geoip-mmdb}";
        E11SYNC_DEBUG = "1";
        LOCALE_ARCHIVE = "${pkgs.glibcLocales}/lib/locale/locale-archive";
        inherit (self.checks.${system}.pre-commit-check) shellHook;
      };

      formatter = pkgs.alejandra;
    })
    // {
      nixosConfigurations.vm = nixpkgs.lib.nixosSystem {
        system = "x86_64-linux";
        modules = [
          "${nixpkgs}/nixos/modules/virtualisation/qemu-vm.nix"
          ./vm.nix
          self.nixosModules.e11sync
        ];
      };
      nixosModules.e11sync = import ./modules/e11sync {
        inherit nixpkgs geoip2-tarball;
      };
    };
}