{
	description = "EmbedTube - A YouTube micro-client for embeded videos";

	inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";

	outputs = { self, nixpkgs }: let
		systems = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" "aarch64-darwin" ];
		forAllSystems = f: nixpkgs.lib.genAttrs systems (system: f nixpkgs.legacyPackages.${system});
	in {
		packages = forAllSystems (pkgs: {
			default = pkgs.buildGoModule {
				pname = "embedtube";
				version = "1.0.0";
				src = ./.;
				vendorHash = "sha256-bVuk+0Ukt8AOueQHRMK1sphjfk9eG5SG9gRLxe3eHJg=";
				meta.mainProgram = "embedtube";
			};
		});

		devShells = forAllSystems (pkgs: {
			default = pkgs.mkShell {
				packages = with pkgs; [ go gopls gotools ];
			};
		});

		nixosModules.default = { config, lib, pkgs, ... }: let
			cfg = config.services.embedtube;
			haveAPIKey = cfg.apiKeyFile != null;
		in {
			options.services.embedtube = {
				enable = lib.mkEnableOption "enable embedtube service";
				package = lib.mkOption {
					type = lib.types.package;
					default = self.packages.${pkgs.stdenv.hostPlatform.system}.default;
					defaultText = lib.literalExpression "embedtube.packages.\${system}.default";
					description = "The embedtube package to use";
				};
				port = lib.mkOption {
					type = lib.types.port;
					default = 8080;
					description = "port to listen on";
				};
				listenAddress = lib.mkOption {
					type = lib.types.str;
					default = "127.0.0.1";
					description = "address to bind to";
				};
				openFirewall = lib.mkEnableOption "open the listen port in the firewall";
				apiKeyFile = lib.mkOption {
					type = lib.types.nullOr lib.types.path;
					default = null;
					description = "file containing api key, not to be included in nix store";
				};
			};

			config = lib.mkIf cfg.enable {
				networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [ cfg.port ];
				systemd.services.embedtube = {
					description = "embedtube";
					wantedBy = [ "multi-user.target" ];
					after = [ "network-online.target" ];
					wants = [ "network-online.target" ];
					serviceConfig = {
						ExecStart = lib.getExe cfg.package;
						LoadCredential = lib.mkIf haveAPIKey [ "api_key:${cfg.apiKeyFile}" ];
						Restart = "on-failure";
						DynamicUser = true;
					};
					environment = {
						PORT = toString cfg.port;
						HOST = cfg.listenAddress;
						API_KEY_FILE = lib.mkIf haveAPIKey "%d/api_key";
					};
				};
			};
		};
	};
}