{
  description = "HortusFox — self-hosted plant manager, from source";

  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
  inputs.utils.url = "github:numtide/flake-utils";
  inputs.systems.url = "github:nix-systems/default";

  outputs =
    { self, nixpkgs, utils, systems, ... }:
    utils.lib.eachSystem (import systems) (system:
    let
      pkgs = import nixpkgs { inherit system; };
    in
    { packages = {
        hortusfox-web = pkgs.callPackage ./package.nix { };
        default = pkgs.callPackage ./package.nix { };
      };

      # Matches the PHP build used by services.hortusfox-web (see
      # nixos-module/default.nix's phpPackage) plus composer, for working
      # on package.nix itself (bumping version/hashes, testing the
      # Composer install) or poking at the app's PHP directly -- `just`/
      # `nom` are what the justfile recipes assume are on PATH.
      devShells.default = pkgs.mkShell {
        packages = [
          pkgs.just
          pkgs.nix-output-monitor
          (pkgs.php83.buildEnv {
            extensions = ({ enabled, all }:
              enabled ++ (with all; [ pdo_mysql mysqli gd exif fileinfo mbstring curl zip openssl ]));
          })
          pkgs.php83Packages.composer
        ];
      };

      # `nix flake check` builds the package to catch breakage early.
      checks = {
        build = pkgs.callPackage ./package.nix { };

        vm-test = import ./tests/vm-test.nix {
          inherit pkgs;
          nixosModule = self.nixosModules.default;
          proxyServer = "nginx";
        };

        vm-test-caddy = import ./tests/vm-test.nix {
          inherit pkgs;
          nixosModule = self.nixosModules.default;
          proxyServer = "caddy";
        };
      };
    }) // {
      # Not per-system: an overlay is keyed by name, not by system.
      overlays.default = final: prev: { hortusfox-web = final.callPackage ./package.nix { }; };

      # Not per-system: a module is keyed by name, not by system.
      nixosModules.default = import ./nixos-module;

      # Throwaway VM for manual testing (`just build-vm` / `just boot-vm`).
      # Not per-system: nixosConfigurations is keyed by config name, not system.
      nixosConfigurations.test = nixpkgs.lib.nixosSystem {
        system = "x86_64-linux";
        modules = [ ./tests ];
      };
    };
}