{
  description = "Iota";

  inputs = {
    nixpkgs.url = "github:nixos/nixpkgs?ref=nixos-unstable";
    flake-parts.url = "github:hercules-ci/flake-parts";
    rust-overlay = {
      url = "github:oxalica/rust-overlay";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    mtp-type-maps = {
      url = "git+https://git.methanium.net/tensamin/mtp-type-maps";
      flake = false;
    };
  };

  outputs =
    inputs@{
      self,
      nixpkgs,
      flake-parts,
      rust-overlay,
      ...
    }:
    flake-parts.lib.mkFlake { inherit inputs; } {
      systems = [
        "x86_64-linux"
        "aarch64-linux"
        "x86_64-darwin"
        "aarch64-darwin"
      ];

      perSystem =
        {
          self',
          pkgs,
          system,
          ...
        }:
        let
          rustPkgs = import nixpkgs {
            inherit system;
            overlays = [ (import rust-overlay) ];
          };
          rustToolchain = rustPkgs.rust-bin.stable.latest.default.override {
            extensions = [
              "rust-src"
              "rust-analyzer"
              "clippy"
              "rustfmt"
            ];
          };
          commonBuildInputs = with pkgs; [
            openssl
            sqlite
          ];
          commonNativeBuildInputs = with pkgs; [
            cmake
            perl
            pkg-config
          ];
        in
        {
          packages = {
            default = pkgs.rustPlatform.buildRustPackage {
              pname = "iota";
              version = "0.1.0";
              src = ./.;
              cargoBuildFlags = [
                "-p"
                "iota"
                "-p"
                "iota-daemon"
                "-p"
                "iota-updater"
                "-p"
                "iota-installer"
              ];
              cargoLock = {
                lockFile = ./Cargo.lock;
                allowBuiltinFetchGit = true;
              };
              nativeBuildInputs = commonNativeBuildInputs;
              buildInputs = commonBuildInputs;
              dontUseCmakeConfigure = true;
              MTP_TYPE_MAPS = "${inputs.mtp-type-maps}/type-maps.yaml";
              passthru.dataDir = "/var/lib/iota";
            };

            iota-daemon = self'.packages.default.overrideAttrs (old: {
              pname = "iota-daemon";
              cargoBuildFlags = [
                "-p"
                "iota-daemon"
              ];
              postInstall = ''
                for f in $out/bin/*; do
                  if [ "$(basename "$f")" != "iota-daemon" ]; then
                    rm "$f"
                  fi
                done
              '';
            });

            iota-ui = self'.packages.default.overrideAttrs (old: {
              pname = "iota-ui";
              cargoBuildFlags = [
                "-p"
                "iota"
              ];
              postInstall = ''
                for f in $out/bin/*; do
                  if [ "$(basename "$f")" != "iota" ]; then
                    rm "$f"
                  fi
                done
                if [ -f "$out/bin/iota" ]; then
                  mv "$out/bin/iota" "$out/bin/iota-ui"
                fi
              '';
            });
          };

          devShells.default = pkgs.mkShell {
            nativeBuildInputs = with pkgs; [
              rustToolchain
              git
              cmake
              perl
              pkg-config
            ];
            buildInputs = commonBuildInputs;
          };
        };

      flake = {
        nixosModules.default =
          {
            config,
            pkgs,
            lib,
            ...
          }:
          let
            cfg = config.services.iota;
            defaultPackage =
              self.packages.${pkgs.stdenv.hostPlatform.system}.default
                or (throw "iota: no pre-built package for system ${pkgs.stdenv.hostPlatform.system}");

            configFormat = pkgs.formats.yaml { };
            effectiveSettings = lib.recursiveUpdate {
              port = cfg.port;
              web = {
                mode = "network";
                bind = cfg.bindAddress;
                port = cfg.port;
                required = true;
              }
              // lib.optionalAttrs (cfg.certFile != null) {
                certificate = "${cfg.stateDir}/tls/cert.pem";
                key = "${cfg.stateDir}/tls/key.pem";
              };
            } cfg.settings;
            sourceConfigFile =
              if cfg.settingsFile != null then
                cfg.settingsFile
              else
                configFormat.generate "iota-config.yaml" effectiveSettings;
            configFile = "${cfg.stateDir}/config.yaml";

            descriptionText = "Tensamin Iota daemon";
          in
          {
            options.services.iota = {
              enable = lib.mkEnableOption "Enable the Iota service.";

              stateDir = lib.mkOption {
                type = lib.types.str;
                default = "/var/lib/iota";
                description = "Persistent mutable Iota state.";
              };
              cacheDir = lib.mkOption {
                type = lib.types.str;
                default = "/var/cache/iota";
              };
              runtimeDir = lib.mkOption {
                type = lib.types.str;
                default = "/run/iota";
              };
              logDir = lib.mkOption {
                type = lib.types.str;
                default = "/var/log/iota";
              };
              assetDir = lib.mkOption {
                type = lib.types.str;
                default = "${cfg.package}/share/iota/web";
              };

              certFile = lib.mkOption {
                type = lib.types.nullOr lib.types.str;
                default = null;
                description = "Path to the SSL certificate file (cert.pem).";
              };

              keyFile = lib.mkOption {
                type = lib.types.nullOr lib.types.str;
                default = null;
                description = "Path to the SSL private key file (cert.key).";
              };

              environmentFiles = lib.mkOption {
                type = lib.types.listOf lib.types.str;
                default = [ ];
                description = "Environment files to load for the Iota service.";
              };

              openFirewall = lib.mkOption {
                type = lib.types.bool;
                default = true;
                description = "Whether to open the firewall for ports used by Iota.";
              };

              bindAddress = lib.mkOption {
                type = lib.types.str;
                default = "0.0.0.0";
                description = "IP address to bind the HTTP server to.";
              };

              port = lib.mkOption {
                type = lib.types.port;
                default = 1984;
                description = "TCP and UDP port for protocol-only Iota.";
              };

              omegaApiUrl = lib.mkOption {
                type = lib.types.str;
                default = "https://omega.tensamin.net";
                description = "Omega discovery API URL.";
              };

              package = lib.mkOption {
                type = lib.types.package;
                default = defaultPackage;
                description = "The Iota package to use.";
              };

              settings = lib.mkOption {
                type = lib.types.attrs;
                default = { };
                description = "Configuration attributes for Iota, written to YAML.";
              };

              settingsFile = lib.mkOption {
                type = lib.types.nullOr lib.types.path;
                default = null;
                description = "Path to an existing YAML file to use instead of generating from settings.";
              };
            };

            config = lib.mkIf cfg.enable {
              assertions = [
                {
                  assertion = (cfg.certFile == null) == (cfg.keyFile == null);
                  message = "services.iota: certFile and keyFile must be set together.";
                }
              ];

              users.users.iota = {
                isSystemUser = true;
                group = "iota";
                home = cfg.stateDir;
                createHome = true;
                description = "Iota service user";
                shell = pkgs.bash;
              };

              users.groups.iota = { };

              systemd.sockets.iota = {
                description = "${descriptionText} IPC socket";
                wantedBy = [ "sockets.target" ];
                socketConfig = {
                  ListenStream = "/run/iota/iota.sock";
                  SocketMode = "0660";
                  SocketUser = "iota";
                  SocketGroup = "iota";
                  DirectoryMode = "0750";
                  Backlog = 5;
                  RemoveOnStop = "true";
                  NonBlocking = true;
                };
              };

              systemd.services.iota = {
                description = descriptionText;
                wantedBy = [ "multi-user.target" ];
                after = [
                  "network.target"
                  "iota.socket"
                ];
                requires = [ "iota.socket" ];

                environment.OMEGA_API_URL = cfg.omegaApiUrl;

                serviceConfig = {
                  Type = "simple";
                  User = "iota";
                  Group = "iota";
                  ExecStart = "${cfg.package}/bin/iota-daemon";

                  Restart = "on-failure";
                  RestartSec = "5s";
                  RuntimeDirectory = "iota";
                  RuntimeDirectoryMode = "0750";
                  StateDirectory = "iota";
                  StateDirectoryMode = "0750";
                  CacheDirectory = "iota";
                  CacheDirectoryMode = "0750";
                  LogsDirectory = "iota";
                  LogsDirectoryMode = "0750";

                  # Exit code 75 = restart requested
                  RestartPreventExitStatus = "0";
                  RestartForceExitStatus = "75";

                  TimeoutStopSec = "10";
                  KillMode = "mixed";
                  KillSignal = "SIGTERM";

                  AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
                  CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];

                  ProtectSystem = "strict";
                  ProtectHome = true;
                  PrivateTmp = true;
                  NoNewPrivileges = true;
                  ReadWritePaths = [
                    cfg.stateDir
                    cfg.cacheDir
                    cfg.runtimeDir
                    cfg.logDir
                  ];
                  ReadOnlyPaths = [
                    cfg.assetDir
                  ];
                  ProtectKernelTunables = true;
                  ProtectKernelModules = true;
                  ProtectControlGroups = true;
                  RestrictRealtime = true;
                  RestrictSUIDSGID = true;
                  LockPersonality = true;
                  MemoryDenyWriteExecute = true;
                  Environment = [
                    "IOTA_SOCKET=/run/iota/iota.sock"
                    "IOTA_CONFIG_FILE=${configFile}"
                    "IOTA_STATE_DIR=${cfg.stateDir}"
                    "IOTA_CACHE_DIR=${cfg.cacheDir}"
                    "IOTA_RUNTIME_DIR=${cfg.runtimeDir}"
                    "IOTA_LOG_DIR=${cfg.logDir}"
                    "IOTA_ASSET_DIR=${cfg.assetDir}"
                    "IOTA_DEPLOYMENT_MODE=system_socket_activated"
                    "IOTA_SUPERVISOR=systemd"
                  ];
                  ExecStartPre = "+${pkgs.writeShellScript "iota-setup" ''
                    # ponytail: Preserve daemon-assigned IDs; remove config.yaml to reseed changed declarative settings.
                    if [ ! -e ${configFile} ]; then
                      install -m 0640 -o iota -g iota ${sourceConfigFile} ${configFile}
                    fi
                    ${lib.optionalString (cfg.certFile != null) ''
                      install -d -m 0700 -o iota -g iota ${cfg.stateDir}/tls
                      install -m 0644 -o iota -g iota ${cfg.certFile} ${cfg.stateDir}/tls/cert.pem
                      install -m 0600 -o iota -g iota ${cfg.keyFile} ${cfg.stateDir}/tls/key.pem
                    ''}
                  ''}";
                }
                // lib.optionalAttrs (cfg.environmentFiles != [ ]) {
                  EnvironmentFile = cfg.environmentFiles;
                };
              };

              networking.firewall = lib.mkIf cfg.openFirewall {
                allowedTCPPorts = [ cfg.port ];
                allowedUDPPorts = [ cfg.port ];
              };
            };
          };
      };
    };
}