{
  description = "Spread — dev shell: Go, air live-reload, and a local Postgres";

  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";

  outputs = { self, nixpkgs }:
    let
      systems = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" "aarch64-darwin" ];
      forAll = f: nixpkgs.lib.genAttrs systems (system: f nixpkgs.legacyPackages.${system});
    in
    {
      packages = forAll (pkgs: {
        default = pkgs.buildGoModule {
          pname = "spread";
          version = "0.1.0";
          src = ./.;
          vendorHash = "sha256-YaOsSrH0pG+H+9ntjcyRjUgA6l0wgcg7PksrerMfyGg=";
          subPackages = [ "." ];
          ldflags = [ "-s" "-w" ];
        };
      });

      # Import into a NixOS host and set services.spread.{domain,acmeEmail}.
      nixosModules.default = { config, lib, pkgs, ... }:
        let cfg = config.services.spread;
        in {
          options.services.spread = {
            enable = lib.mkEnableOption "Spread BOM re-quoting app";
            package = lib.mkOption {
              type = lib.types.package;
              default = self.packages.${pkgs.system}.default;
              description = "The spread package to run.";
            };
            domain = lib.mkOption {
              type = lib.types.str;
              example = "spread.example.com";
              description = "Public hostname served over HTTPS.";
            };
            acmeEmail = lib.mkOption {
              type = lib.types.str;
              description = "Contact email for Let's Encrypt.";
            };
            port = lib.mkOption {
              type = lib.types.port;
              default = 8137;
            };
            mailBackend = lib.mkOption {
              type = lib.types.enum [ "log" "smtp" "sendgrid" ];
              default = "log";
            };
            environmentFile = lib.mkOption {
              type = lib.types.nullOr lib.types.path;
              default = null;
              description = "Secrets file (SMTP_*, SENDGRID_API_KEY, MAIL_FROM); kept out of the Nix store.";
            };
          };

          config = lib.mkIf cfg.enable {
            users.users.spread = { isSystemUser = true; group = "spread"; };
            users.groups.spread = { };

            services.postgresql = {
              enable = true;
              ensureDatabases = [ "spread" ];
              ensureUsers = [{ name = "spread"; ensureDBOwnership = true; }];
            };

            systemd.services.spread = {
              description = "Spread app";
              after = [ "network.target" "postgresql.service" ];
              wants = [ "postgresql.service" ];
              wantedBy = [ "multi-user.target" ];
              environment = {
                PORT = toString cfg.port;
                DATABASE_URL = "postgresql:///spread?host=/run/postgresql";
                SPREAD_BASE_URL = "https://${cfg.domain}";
                SPREAD_SECURE_COOKIES = "1";
                MAIL_BACKEND = cfg.mailBackend;
              };
              serviceConfig = {
                ExecStart = "${cfg.package}/bin/spread";
                User = "spread";
                Group = "spread";
                Restart = "on-failure";
                NoNewPrivileges = true;
                ProtectSystem = "strict";
                ProtectHome = true;
                PrivateTmp = true;
              } // lib.optionalAttrs (cfg.environmentFile != null) {
                EnvironmentFile = cfg.environmentFile;
              };
            };

            security.acme = {
              acceptTerms = true;
              defaults.email = cfg.acmeEmail;
            };

            services.nginx = {
              enable = true;
              recommendedProxySettings = true;
              recommendedTlsSettings = true;
              virtualHosts.${cfg.domain} = {
                enableACME = true;
                forceSSL = true;
                locations."/".proxyPass = "http://127.0.0.1:${toString cfg.port}";
              };
            };

            networking.firewall.allowedTCPPorts = [ 80 443 ];
          };
        };

      devShells = forAll (pkgs: {
        default = pkgs.mkShell {
          packages = [ pkgs.go pkgs.air pkgs.postgresql_17 ];

          # A throwaway Postgres lives under the project dir so `air` can run the
          # full app (accounts) without touching any real database.
          shellHook = ''
            # Keep the dev Postgres OUT of the project tree — a unix socket in
            # $PWD breaks `nix build`/`nix develop` (Nix can't copy a socket).
            export SPREAD_STATE="''${XDG_STATE_HOME:-$HOME/.local/state}/spread"
            export PGDATA="$SPREAD_STATE/pgdata"
            export PGHOST="$SPREAD_STATE/sock"
            export PGUSER=postgres
            export DATABASE_URL="postgres://postgres@/spread?host=$PGHOST"
            # Dev-forgiving: serve the public demo even if Postgres isn't running.
            export SPREAD_DB_OPTIONAL=1
            # Invite / password-reset emails print to the server log in dev.
            export MAIL_BACKEND=log
            export SPREAD_BASE_URL="http://localhost:8137"

            pg-start() {
              mkdir -p "$PGHOST"
              [ -d "$PGDATA" ] || initdb -D "$PGDATA" -U postgres --auth=trust >/dev/null
              pg_ctl -D "$PGDATA" -o "-k $PGHOST -c listen_addresses=" -w start
              createdb spread 2>/dev/null && echo "created database 'spread'" || true
            }
            pg-stop() { pg_ctl -D "$PGDATA" stop -m fast; }
            spread-admin() {
              SPREAD_ADMIN_PASSWORD="''${2:-changeme123}" go run . init-admin "''${1:-admin@spread.test}"
            }

            echo "spread dev shell"
            echo "  air           — run with live reload (rebuilds on .go/.html/.js/.sql change)"
            echo "  pg-start      — start the local dev Postgres (needed for /login /admin /app)"
            echo "  pg-stop       — stop it"
            echo "  spread-admin <email> <password>  — create/reset the admin user"
          '';
        };
      });
    };
}