{
  inputs = {
    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";

    flake-utils.url = "github:numtide/flake-utils";

    rust-overlay.url = "github:oxalica/rust-overlay";
    rust-overlay.inputs.nixpkgs.follows = "nixpkgs";
    rust-overlay.inputs.flake-utils.follows = "flake-utils";

    naersk.url = "github:nmattia/naersk";
    naersk.inputs.nixpkgs.follows = "nixpkgs";
  };

  outputs = { self, nixpkgs, rust-overlay, flake-utils, naersk }: flake-utils.lib.eachDefaultSystem (system:
    let
      overlays = [
        rust-overlay.overlays.default
      ];
      pkgs = import nixpkgs { inherit system overlays; };
      rustToolchain = pkgs.rust-bin.fromRustupToolchainFile ./rust-toolchain.toml;
      naerskLib = pkgs.callPackage naersk {
        rustc = rustToolchain;
        cargo = rustToolchain;
      };
    in
    rec {
      packages = {
        password-hash-self-service = naerskLib.buildPackage {
          src = self;

          nativeBuildInputs = with pkgs; [
            binaryen # wasm-opt
            trunk
            wasm-bindgen-cli
          ];

          # required, otherwise the dependencies are built for the host system
          CARGO_BUILD_TARGET = "wasm32-unknown-unknown";

          overrideMain = (o: o // {
            buildPhase = ''
              runHook preBuild
              trunk build --release --offline --frozen
              runHook postBuild
            '';

            installPhase = ''
              runHook preInstall
              cp -r dist $out
              runHook postInstall
            '';
          });
        };

        default = packages.password-hash-self-service;
      };

      devShell = pkgs.mkShell {
        buildInputs = with pkgs; [
          binaryen # wasm-opt
          rustToolchain
          trunk
          wasm-bindgen-cli
        ];
      };
    });
}