{
  description = "idCoop: lightweight identity provider";

  inputs = {
    nixpkgs.url = "nixpkgs/nixos-24.05";
    
    utils.url = "github:numtide/flake-utils";
    
    naersk.url = "github:nix-community/naersk";
    naersk.inputs.nixpkgs.follows = "nixpkgs";
  };

  outputs = { self, nixpkgs, utils, naersk }:
    utils.lib.eachDefaultSystem (system: let
      pkgs = nixpkgs.legacyPackages."${system}";
      lib = pkgs.lib;

      naersk' = pkgs.callPackage naersk {
      };

      idcoop = naersk'.buildPackage {
        pname = "idcoop";

        # filter out .nix files from the input so they don't cause a recompilation when changed
        src = lib.cleanSourceWith {
          filter = path: type: !lib.hasSuffix ".nix" path;
          src = ./.;
        };

        nativeBuildInputs = [
          pkgs.makeWrapper

          pkgs.pkg-config
          pkgs.openssl
        ];

        postInstall = ''
          mkdir -p $out/share/idcoop
          echo :::
          ls
          echo :::
          cp -r static templates translations -t $out/share/idcoop/

          wrapProgram $out/bin/idcoop --set HORNBEAM_BASE $out/share/idcoop
        '';
      };
    in {
      # `nix build`
      packages = {
        inherit idcoop;
        default = idcoop;
      };

      # `nix run`
      apps = rec {
        idcoop = utils.lib.mkApp {
          drv = idcoop;
        };
        default = idcoop;
      };
    }) // (let
      forAllNixosSystems = nixpkgs.lib.genAttrs ["x86_64-linux" "aarch64-linux"];
    in {
      # NixOS Modules
      nixosModules = {
        idcoop = import ./nixos_module.nix self;
      };
      checks = forAllNixosSystems (system: let
        checkArgs = {
          pkgs = nixpkgs.legacyPackages.${system};
          inherit self;
        };
      in {
        starts = import ./nixos_tests/starts.nix checkArgs;
      });
    });
}