{
  description = "age encrypted secrets vault for Nix flakes";

  inputs = {
    systems.url = "github:nix-systems/default";
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
  };

  outputs = {
    self,
    nixpkgs,
    ...
  } @ inputs: let
    systems = import inputs.systems;

    mkPkgs = system: repo:
      import repo {
        inherit system;
        allowUnfree = false;
        allowBroken = false;
        overlays = builtins.attrValues self.overlays or {};
      };

    forAllSystems = f:
      nixpkgs.lib.genAttrs systems (system:
        f rec {
          inherit system;
          inherit (pkgs) lib;
          pkgs = mkPkgs system nixpkgs;
        });
  in {
    devShells = forAllSystems (
      {
        pkgs,
        lib,
        ...
      }: {
        default = pkgs.mkShell rec {
          name = "vaultage";
          shell = "${pkgs.bash}/bin/bash";

          # packages we need at runtime
          packages = with pkgs; [
            rustc
            cargo
            cargo-mommy

            rust-analyzer-unwrapped
            (rustfmt.override {asNightly = true;})
            clippy
            taplo
          ];

          # packages we need at build time
          nativeBuildInputs = with pkgs; [
            rustPlatform.bindgenHook
            pkg-config
          ];

          # packages we link against
          buildInputs = [];

          env.LD_LIBRARY_PATH = builtins.toString (lib.makeLibraryPath buildInputs);
        };
      }
    );
  };
}