{
  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";

    rust-overlay.url = "github:oxalica/rust-overlay";
    rust-overlay.inputs.nixpkgs.follows = "nixpkgs";
  };

  outputs = { self, nixpkgs, rust-overlay }:
  let
    inherit (nixpkgs) lib;

    systems = [
      "x86_64-linux"
      "aarch64-linux"
      "x86_64-darwin"
      "aarch64-darwin"
      "armv7l-linux"
    ];

    forAllSystems = f: lib.genAttrs systems (system: let
      pkgs = import nixpkgs {
        inherit system;
        overlays = [
          (import rust-overlay)
        ];
      };

      rust-bin = rust-overlay.lib.mkRustBin { } pkgs.buildPackages;
      toolchain = rust-bin.stable.latest.default.override {
        extensions = [ "rust-src" "rust-analyzer" "rust-std" ];
      };
    in f system pkgs toolchain);
  in {
    apps = let
      mkApp = program: description: {
        type = "app";
        program = toString program;
        meta = {
          inherit description;
        };
      };
      mkVm = name: mkApp "${self.nixosConfigurations.${name}.config.system.build.vm}/bin/run-nixos-vm";
    in forAllSystems (system: pkgs: _: {
      default = self.apps.${system}.vm;
      vm = mkVm "vm" "Start a NixOS VM with bro installed";
    });

    devShells = forAllSystems (system: pkgs: toolchain: {
      default = pkgs.mkShell {
        nativeBuildInputs = with pkgs; [
          toolchain

          cargo-nextest
          cargo-edit
          cargo-deny
        ];

        env.RUST_SRC_PATH = "${toolchain}/lib/rustlib/src/rust/library";
      };
    });

    overlays = {
      default = self.overlays.bro;
      bro = final: prev: {
        inherit (self.packages.${prev.stdenv.hostPlatform.system}) bro;
      };
    };

    nixosModules = {
      default = self.nixosModules.bro;
      bro = import ./nix/module.nix;
    };

    nixosConfigurations = {
      vm = import ./nix/vm.nix { inherit self nixpkgs; };
    };

    packages = forAllSystems (system: pkgs: _:
      let
      cargoToml = fromTOML (builtins.readFile ./Cargo.toml);
      cargoLock = ./Cargo.lock;
      src = lib.fileset.toSource {
        root = ./.;
        fileset = lib.fileset.unions [
          ./Cargo.toml
          ./Cargo.lock
          ./src
        ];
      };
    in {
      default = self.packages.${system}.bro;

      bro = pkgs.callPackage ./nix/default.nix { inherit cargoToml cargoLock src; };
      filteredSource = pkgs.runCommandLocal "filtered-source" { } ''
        ln -s ${src} $out
      '';
    });

    checks = forAllSystems (system: pkgs: _: {
      inherit (self.packages.${system}) bro;
    });
  };
}