{
  inputs = {
    flake-utils.url = "github:numtide/flake-utils";
    naersk.url = "github:nix-community/naersk";
  };

  outputs = { self, nixpkgs, flake-utils, naersk }:
    flake-utils.lib.eachDefaultSystem (
      system: let
        pkgs = nixpkgs.legacyPackages."${system}";
        naersk-lib = naersk.lib."${system}";
      in
        rec {
          # `nix build`
          packages.waifud = naersk-lib.buildPackage {
            pname = "waifud";
            root = ./.;
          };
          defaultPackage = packages.waifud;

          # `nix run`
          apps.waifud = flake-utils.lib.mkApp {
            drv = packages.waifud;
          };
          defaultApp = apps.waifud;

          nixosModules.waifud = { config, lib, ... }: {
            options = with lib; {
              cara.services.waifud.enable = mkEnableOption "enable waifud";
              cara.services.waifud.environmentFileLocation = mkOption {
                type = types.str;
                default = "/var/lib/waifud/.env";
                description = "The location of the environment file";
              };
              cara.services.waifud.port = mkOption {
                type = types.port;
                default = 3000;
                description = "port to bind to";
              };
            };

            config = lib.mkIf config.cara.services.waifud.enable {
              users.groups.waifud = {
                members = [ "waifud" ];
              };
              users.users.waifud = {
                createHome = true;
                isSystemUser = true;
                home = "/var/lib/waifud";
                group = "waifud";
                extraGroups = [ "libvirtd" ];
              };

              systemd.services.waifud = {
                wantedBy = [ "multi-user.target" ];

                serviceConfig = {
                  User = "waifud";
                  Group = "waifud";
                  Restart = "always";
                  WorkingDirectory = "${defaultPackage}";
                  ExecStart = "${defaultPackage}/bin/waifud";
                  EnvironmentFIle = "${config.cara.services.waifud.environmentFileLocation}";
                };
              };
              
              networking.firewall.allowedTCPPorts = [ config.cara.services.waifud.port ];
              
            };
          };

          # `nix develop`
          devShell = pkgs.mkShell {
            nativeBuildInputs = with pkgs; [ rustc cargo ];
          };
        }
    );
}