{
  description = "tailscalesd service discovery daemon";

  inputs = {
    nixpkgs.url = "https://flakehub.com/f/NixOS/nixpkgs/0.1";
    pyproject-nix = {
      url = "github:pyproject-nix/pyproject.nix";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    uv2nix = {
      url = "github:pyproject-nix/uv2nix";
      inputs.pyproject-nix.follows = "pyproject-nix";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    pyproject-build-systems = {
      url = "github:pyproject-nix/build-system-pkgs";
      inputs.pyproject-nix.follows = "pyproject-nix";
      inputs.uv2nix.follows = "uv2nix";
      inputs.nixpkgs.follows = "nixpkgs";
    };
  };

  outputs =
    {
      self,
      nixpkgs,
      pyproject-nix,
      uv2nix,
      pyproject-build-systems,
      ...
    }:
    let
      systems = [ "x86_64-linux" ];
      forAllSystems = fn: nixpkgs.lib.genAttrs systems (system: fn nixpkgs.legacyPackages.${system});

      workspace = uv2nix.lib.workspace.loadWorkspace { workspaceRoot = ./.; };
      projectOverlay = workspace.mkPyprojectOverlay { sourcePreference = "wheel"; };

      mkPythonSet =
        pkgs:
        (pkgs.callPackage pyproject-nix.build.packages {
          python = pkgs.python311;
        }).overrideScope
          (
            pkgs.lib.composeManyExtensions [
              pyproject-build-systems.overlays.default
              projectOverlay
            ]
          );

      mkTailscalesdPackage =
        pkgs:
        let
          pythonSet = mkPythonSet pkgs;
        in
        pythonSet.mkVirtualEnv "tailscalesd-env" workspace.deps.default;

      mkTailscalesdTestEnv =
        pkgs:
        let
          pythonSet = mkPythonSet pkgs;
        in
        pythonSet.mkVirtualEnv "tailscalesd-test-env" {
          tailscalesd = [ "dev" ];
        };

      mkModuleWithPackage =
        modulePath:
        { pkgs, ... }:
        {
          imports = [ modulePath ];
          _module.args.tailscalesdPackage = self.packages.${pkgs.stdenv.hostPlatform.system}.tailscalesd;
        };
    in
    {
      formatter = forAllSystems (pkgs: pkgs.nixfmt-rfc-style);

      packages = forAllSystems (
        pkgs:
        let
          tailscalesd = mkTailscalesdPackage pkgs;
        in
        {
          inherit tailscalesd;
          default = tailscalesd;
        }
      );

      apps = forAllSystems (
        pkgs:
        let
          tailscalesd = self.packages.${pkgs.stdenv.hostPlatform.system}.tailscalesd;
        in
        {
          tailscalesd = {
            type = "app";
            program = "${tailscalesd}/bin/tailscalesd";
          };
          default = {
            type = "app";
            program = "${tailscalesd}/bin/tailscalesd";
          };
        }
      );

      checks = forAllSystems (
        pkgs:
        let
          system = pkgs.stdenv.hostPlatform.system;
          tailscalesd = self.packages.${system}.tailscalesd;
          testEnv = mkTailscalesdTestEnv pkgs;
          src = ./.;
          moduleEval = nixpkgs.lib.nixosSystem {
            inherit system;
            modules = [
              self.nixosModules.tailscalesd
              {
                system.stateVersion = "24.11";
                services.tailscalesd.enable = true;
                services.tailscalesd.credentials.bearerTokenFile = "/dev/null";
                services.tailscalesd.credentials.clientIdFile = "/dev/null";
                services.tailscalesd.credentials.clientSecretFile = "/dev/null";
              }
            ];
          };
        in
        {
          formatter = self.formatter.${system};
          package-default = tailscalesd;
          package-tailscalesd = tailscalesd;

          module-eval = pkgs.runCommand "tailscalesd-module-eval" { } ''
            test -n '${moduleEval.config.systemd.services.tailscalesd.serviceConfig.ExecStart}'
            touch $out
          '';

          tailscalesd-unit-tests = pkgs.stdenv.mkDerivation {
            name = "tailscalesd-unit-tests";
            inherit src;
            dontConfigure = true;
            dontBuild = true;
            nativeBuildInputs = [ testEnv ];
            checkPhase = ''
              runHook preCheck
              export HOME=$(mktemp -d)
              pytest tests/ -v
              runHook postCheck
            '';
            doCheck = true;
            installPhase = ''
              mkdir -p $out
              touch $out/passed
            '';
          };

          tailscalesd-ruff = pkgs.stdenv.mkDerivation {
            name = "tailscalesd-ruff";
            inherit src;
            dontConfigure = true;
            dontBuild = true;
            nativeBuildInputs = [ testEnv ];
            checkPhase = ''
              runHook preCheck
              ruff check tailscalesd/ tests/
              ruff format --check tailscalesd/ tests/
              runHook postCheck
            '';
            doCheck = true;
            installPhase = ''
              mkdir -p $out
              touch $out/passed
            '';
          };

          tailscalesd-pyright = pkgs.stdenv.mkDerivation {
            name = "tailscalesd-pyright";
            inherit src;
            dontConfigure = true;
            dontBuild = true;
            nativeBuildInputs = [
              testEnv
              pkgs.nodejs
            ];
            checkPhase = ''
              runHook preCheck
              export HOME=$(mktemp -d)
              pyright tailscalesd/ tests/
              runHook postCheck
            '';
            doCheck = true;
            installPhase = ''
              mkdir -p $out
              touch $out/passed
            '';
          };
        }
      );

      nixosModules = {
        tailscalesd = mkModuleWithPackage ./nix/modules/nixos/services/tailscalesd.nix;
        default = mkModuleWithPackage ./nix/modules/nixos/default.nix;
      };
    };
}