{
  description = "erl_iroh — distributed Erlang over iroh P2P + TLS, with a bot powers SDK";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
    flake-utils.url = "github:numtide/flake-utils";
  };

  outputs =
    {
      self,
      nixpkgs,
      flake-utils,
    }:
    flake-utils.lib.eachDefaultSystem (
      system:
      let
        pkgs = import nixpkgs { inherit system; };
        inherit (pkgs) lib;

        erl-iroh = pkgs.rustPlatform.buildRustPackage {
          pname = "erl-iroh";
          version = "0.1.0";
          src = lib.cleanSourceWith {
            src = ./.;
            filter =
              path: type:
              let
                base = baseNameOf path;
              in
              !(
                lib.hasInfix "/target" path
                || lib.hasInfix "/.git" path
                || base == "target"
                || base == "result"
                || base == ".git"
              );
          };

          cargoLock.lockFile = ./Cargo.lock;

          nativeBuildInputs = [
            pkgs.pkg-config
            pkgs.cmake
            pkgs.perl
          ];

          # aws-lc-sys / ring need a C toolchain; no OpenSSL linkage required.
          doCheck = true;
          # Integration-style unit tests are pure; keep checks on.
          checkFlags = [ ];

          meta = {
            description = "Distributed Erlang over iroh P2P + TLS, bot powers SDK";
            homepage = "https://tangled.org/nandi.uk/erl-iroh";
            license = with lib.licenses; [
              mit
              asl20
            ];
            mainProgram = "erl-iroh-demo";
          };
        };
      in
      {
        packages.default = erl-iroh;
        packages.erl-iroh = erl-iroh;

        # Default app: in-process two-bot iroh handshake demo
        apps.default = {
          type = "app";
          program = "${erl-iroh}/bin/erl-iroh-demo";
        };
        apps.demo = {
          type = "app";
          program = "${erl-iroh}/bin/erl-iroh-demo";
        };
        apps.bot = {
          type = "app";
          program = "${erl-iroh}/bin/erl-iroh-bot";
        };
        apps.peer = {
          type = "app";
          program = "${erl-iroh}/bin/erl-iroh-peer";
        };

        devShells.default = pkgs.mkShell {
          packages = [
            pkgs.rustc
            pkgs.cargo
            pkgs.rustfmt
            pkgs.clippy
            pkgs.pkg-config
            pkgs.cmake
            pkgs.perl
            pkgs.rust-analyzer
          ];
          shellHook = ''
            echo "erl-iroh dev shell"
            echo "  cargo run --bin erl-iroh-demo"
            echo "  nix run .#demo"
          '';
        };

        formatter = pkgs.nixfmt-rfc-style;
      }
    );
}