{
  inputs = {
    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";

    flake-utils.url = "github:numtide/flake-utils";

    rust-overlay.url = "github:oxalica/rust-overlay";

    naersk.url = "github:nmattia/naersk";
    naersk.inputs.nixpkgs.follows = "nixpkgs";
  };

  outputs = { self, nixpkgs, rust-overlay, flake-utils, naersk }: flake-utils.lib.eachDefaultSystem (system:
    let
      overlays = [
        rust-overlay.overlay
        (final: prev: {
          rustc = final.rust-bin.nightly.latest.default.override { targets = [ "wasm32-unknown-unknown" ]; };
          cargo = final.rust-bin.nightly.latest.default.override { targets = [ "wasm32-unknown-unknown" ]; };
        })
      ];
      pkgs = import nixpkgs { inherit system overlays; };
      naerskLib = pkgs.callPackage naersk { };
    in
    rec {
      packages = {
        backend = naerskLib.buildPackage {
          src = ./backend;

          nativeBuildInputs = with pkgs; [
            wasm-bindgen-cli
            wasm-pack
          ];

          overrideMain = (o: o // {
            buildPhase = ''
              runHook preBuild
              wasm-pack build --target web --release --mode no-install -- --offline
              runHook postBuild
            '';

            installPhase = ''
              runHook preInstall
              cp -r pkg $out
              runHook postInstall
            '';
          });
        };

        frontend = pkgs.stdenvNoCC.mkDerivation {
          name = "password-hash-self-service";

          src = self;

          dontBuild = true;

          installPhase = ''
            runHook preInstall

            mkdir $out
            cp \
                index.html \
                style.css \
                app.js \
                $out

            mkdir $out/backend
            ln -s ${packages.backend} $out/backend/pkg

            runHook postInstall
          '';
        };
      };

      defaultPackage = packages.frontend;

      devShell = pkgs.mkShell {
        buildInputs = with pkgs; [
          wasm-pack
          (rust-bin.nightly.latest.default.override { targets = [ "wasm32-unknown-unknown" ]; })
        ];
      };

      apps = {
        serve = {
          type = "app";
          program = toString (pkgs.writeShellScript "serve" ''
            ${pkgs.python3}/bin/python3 -m http.server
          '');
        };
      };

      hydraJobs =
        if pkgs.lib.elem system [ "x86_64-linux" ]
        then {
          backend = packages.backend;
          frontend = packages.frontend;
          hydra-product = pkgs.runCommandNoCC "hydra-product" { } ''
            cp -rs ${defaultPackage} $out
            chmod +w $out
            mkdir -p $out/nix-support
            echo "doc app $out" >> $out/nix-support/hydra-build-products
          '';
        }
        else { };
    });
}