{
  description = "Build a cargo project";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";

    crane = {
      url = "github:ipetkov/crane";
      inputs.nixpkgs.follows = "nixpkgs";
    };

    fenix = {
      url = "github:nix-community/fenix";
      inputs.nixpkgs.follows = "nixpkgs";
      inputs.rust-analyzer-src.follows = "";
    };

    flake-utils.url = "github:numtide/flake-utils";

    advisory-db = {
      url = "github:rustsec/advisory-db";
      flake = false;
    };

  };

  outputs =
    { self
    , nixpkgs
    , crane
    , fenix
    , flake-utils
    , advisory-db
    , ...
    }:
    flake-utils.lib.eachDefaultSystem (system:
    let
      pkgs = nixpkgs.legacyPackages.${system};

      inherit (pkgs) lib;

      craneLib = crane.mkLib pkgs;
      src = craneLib.cleanCargoSource (craneLib.path ./.);

      # Common arguments can be set here to avoid repeating them later
      commonArgs = {
        inherit src;
        strictDeps = true;

        buildInputs = with pkgs; [
          pkg-config
          openssl
        ] ++ lib.optionals pkgs.stdenv.isDarwin [
          pkgs.libiconv
        ];

      };

      craneLibLLvmTools = craneLib.overrideToolchain
        (fenix.packages.${system}.complete.withComponents [
          "cargo"
          "llvm-tools"
          "rustc"
        ]);

      # Build *just* the cargo dependencies, so we can reuse
      # all of that work (e.g. via cachix) when running in CI
      cargoArtifacts = craneLib.buildDepsOnly commonArgs;

      # Build the actual crate itself, reusing the dependency
      # artifacts from above.
      i2pd-exporter = craneLib.buildPackage (commonArgs // {
        inherit cargoArtifacts;
      });
    in
    {
      checks = {
        # Build the crate as part of `nix flake check` for convenience
        inherit i2pd-exporter;

        # Run clippy (and deny all warnings) on the crate source,
        # again, reusing the dependency artifacts from above.
        #
        # Note that this is done as a separate derivation so that
        # we can block the CI if there are issues here, but not
        # prevent downstream consumers from building our crate by itself.
        i2pd-exporter-clippy = craneLib.cargoClippy (commonArgs // {
          inherit cargoArtifacts;
          cargoClippyExtraArgs = "--all-targets -- --deny warnings";
        });

        i2pd-exporter-doc = craneLib.cargoDoc (commonArgs // {
          inherit cargoArtifacts;
        });

        # Check formatting
        i2pd-exporter-fmt = craneLib.cargoFmt {
          inherit src;
        };

        # Audit dependencies
        i2pd-exporter-audit = craneLib.cargoAudit {
          inherit src advisory-db;
        };

        # Audit licenses
        i2pd-exporter-deny = craneLib.cargoDeny {
          inherit src;
        };

        # Run tests with cargo-nextest
        # Consider setting `doCheck = false` on `i2pd-exporter` if you do not want
        # the tests to run twice
        i2pd-exporter-nextest = craneLib.cargoNextest (commonArgs // {
          inherit cargoArtifacts;
          partitions = 1;
          partitionType = "count";
        });
      };

      packages = {
        default = i2pd-exporter;
      } // lib.optionalAttrs (!pkgs.stdenv.isDarwin) {
        i2pd-exporter-llvm-coverage = craneLibLLvmTools.cargoLlvmCov (commonArgs // {
          inherit cargoArtifacts;
        });
      };


      apps.default = flake-utils.lib.mkApp {
        drv = i2pd-exporter;
      };

      devShells.default = craneLib.devShell {
        # Inherit inputs from checks.
        checks = self.checks.${system};

        LIBCLANG_PATH = "${pkgs.llvmPackages_17.libclang.lib}/lib";
        RUST_BACKTRACE = 1;
        RUST_SRC_PATH = "${pkgs.rust.packages.stable.rustPlatform.rustLibSrc}";

        packages = with pkgs; [
          rustfmt
          rust-analyzer
          clippy
          openssl
          sqlite
        ];

      };
    });
  nixosModules.default =
    { config
    , lib
    , pkgs
    , ...
    }:
    let
      cfg = config.services.prometheus.exporters.i2pd-exporter;
    in
    {
      options.services.prometheus.exporters.i2pd-exporter = {

        enable = mkEnableOption (lib.mdDoc "lemmy a federated alternative to reddit in rust");

        listenAddress = mkOption {
          type = with types; nullOr str;
          default = "127.0.0.1";
          description = lib.mdDoc "The connection URI to use. Takes priority over the configuration file if set.";
        };

        port = mkOption {
          type = types.port;
          default = 5733;
          description = lib.mdDoc "The connection URI to use. Takes priority over the configuration file if set.";
        };

        routerAddress = mkOption {
          type = with types; nullOr str;
          default = "http://127.0.0.1:7650";
          description = lib.mdDoc "The connection URI to use. Takes priority over the configuration file if set.";
        };

        routerPassword = mkOption {
          type = with types; nullOr str;
          default = "itoopie";
          description = lib.mdDoc "The connection URI to use. Takes priority over the configuration file if set.";
        };



        systemd.services.i2pd-exporter =
          {
            description = "I2PD prometheus exporter";

            environment = {
              IP = cfg.services.prometheus.exporters.i2pd-exporter.listenAddress;
              PORT = cfg.services.prometheus.exporters.i2pd-exporter.port;
              ADDRESS = cfg.services.prometheus.exporters.i2pd-exporter.routerAddress;
              PASSWORD = cfg.services.prometheus.exporters.i2pd-exporter.routerPassword;
            };

            wantedBy = [ "multi-user.target" ];


            serviceConfig = {
              DynamicUser = true;
              RuntimeDirectory = "i2pd-exporter";
              ExecStart = "${cfg.server.package}/bin/i2pdexporter";
              PrivateTmp = true;
              MemoryDenyWriteExecute = true;
              NoNewPrivileges = true;
            };
          };
      };
    };
}