{
  inputs = {
    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";

    flake-utils.url = "github:numtide/flake-utils";

    rust-overlay.url = "github:oxalica/rust-overlay";
    rust-overlay.inputs.nixpkgs.follows = "nixpkgs";
    rust-overlay.inputs.flake-utils.follows = "flake-utils";

    naersk.url = "github:nmattia/naersk";
    naersk.inputs.nixpkgs.follows = "nixpkgs";
  };

  outputs = { self, nixpkgs, rust-overlay, flake-utils, naersk }: flake-utils.lib.eachDefaultSystem (system:
    let
      overlays = [
        rust-overlay.overlays.default
      ];
      pkgs = import nixpkgs { inherit system overlays; };
      rustToolchain = pkgs.rust-bin.fromRustupToolchainFile ./rust-toolchain.toml;
      naerskLib = pkgs.callPackage naersk {
        rustc = rustToolchain;
        cargo = rustToolchain;
      };
    in
    rec {
      packages = {
        backend = naerskLib.buildPackage {
          src = ./backend;

          nativeBuildInputs = with pkgs; [
            binaryen # wasm-opt
            wasm-bindgen-cli
            wasm-pack
          ];

          # required, otherwise the dependencies are built for the host system
          CARGO_BUILD_TARGET = "wasm32-unknown-unknown";
          WASM_PACK_CACHE = "/build/wasm-pack-cache";

          overrideMain = (o: o // {
            buildPhase = ''
              runHook preBuild
              # FIXME this fails when the locked wasm-pack version is different from the one in nixpkgs
              wasm-pack build --target web --release --mode no-install -- --offline
              runHook postBuild
            '';

            installPhase = ''
              runHook preInstall
              cp -r pkg $out
              runHook postInstall
            '';
          });
        };

        frontend = pkgs.stdenvNoCC.mkDerivation {
          name = "password-hash-self-service";

          src = self;

          dontBuild = true;

          installPhase = ''
            runHook preInstall

            mkdir $out
            cp \
                index.html \
                style.css \
                app.js \
                $out

            mkdir $out/backend
            ln -s ${packages.backend} $out/backend/pkg

            runHook postInstall
          '';
        };

        default = packages.frontend;
      };

      devShell = pkgs.mkShell {
        buildInputs = with pkgs; [
          binaryen # wasm-opt
          rustToolchain
          wasm-bindgen-cli
          wasm-pack
        ];
      };

      apps = {
        serve = {
          type = "app";
          program = toString (pkgs.writeShellScript "serve" ''
            ${pkgs.python3}/bin/python3 -m http.server
          '');
        };
      };
    });
}