{
  inputs = {
    nix.url = "git+ssh://git@git.c3c.cz/C3C/nix";
  };

  outputs =
    { self, nix }:
    {
      formatter = nix.formatter;

      packages = nix.lib.forAllSystems (
        pkgs:
        let
          version = "rev-${self.shortRev or self.dirtyShortRev}";
          package = builtins.fromJSON (builtins.readFile ./app/frontend/package.json);
        in
        rec {
          ui = pkgs.buildNpmPackage {
            inherit version;
            pname = "cv";
            src = ./app/frontend;
            npmInstallFlags = "--no-audit --no-progress --no-fund";
            npmDepsHash = "sha256-p4rTpy0t8aajbubvtF1TA83/FFqvfKEOPBb5T0ZRfQY=";
            npmPackFlags = [ "--ignore-scripts" ];
          };

          server = pkgs.buildGoModule {
            inherit version;
            pname = "cv";
            CGO_ENABLED = 0;
            src = ./.;
            subPackages = [ "app/server" ];
            postPatch = ''
              rm -rf app/server/internal/files/data/public
              mkdir -p app/server/internal/files/data/public
              touch app/server/internal/files/data/public/.gitkeep
              cp -Tr ${ui}/lib/node_modules/${package.name}/dist app/server/internal/files/data/public/
              chmod +w -R app/server/internal/files/data/public
              sed -i 's#<script#<script nonce="{{ .CspNonce }}"#g' app/server/internal/files/data/public/index.html
            '';
            ldflags = [
              "-s"
              "-w"
              "-X gopkg.c3c.cz/cv/app/server/internal/version.Tag=${version}"
              "-X gopkg.c3c.cz/cv/app/server/internal/version.Commit=${self.rev or self.dirtyRev}"
              "-X gopkg.c3c.cz/cv/app/server/internal/version.commitTime=${
                builtins.toString (self.lastModified or 0)
              }"
            ];
            vendorHash = "sha256-44xcyVk5KcurQLkVJv1MeAj+Pfcu53664pvVgHdyv3E=";
          };

          image = pkgs.dockerTools.streamLayeredImage {
            name = "cv";
            tag = "current";

            config = {
              Env = [ "SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt" ];
              Entrypoint = [ "${server}/bin/server" ];
            };
          };

        }
      );

      devShells = nix.lib.forAllSystems (pkgs: {
        default = pkgs.devshell.mkShell {
          name = "c3c-cv";

          packages = [
            pkgs.go
            pkgs.nodejs_22
          ];

          commands = [
            {
              # Override golangci-lint for vscode, because the extension incorrectly assumes usage of global binaries is preferred
              name = "golangci-lint";
              command = ''
                CMD=''${1:-}
                if [[ "$CMD" == "run" ]]; then
                  shift
                  ${pkgs.golangci-lint}/bin/golangci-lint run --config ${nix.lib.golangci-config-file} $@
                else
                  ${pkgs.golangci-lint}/bin/golangci-lint $@
                fi
              '';
            }
            {
              name = "lint";
              help = "run linters";
              command = ''
                ${nix.lib.cd_root}
                ${pkgs.golangci-lint}/bin/golangci-lint run --sort-results --out-format tab --config ${nix.lib.golangci-config-file} ./...
                npm --prefix app/frontend run check
              '';
            }
            {
              name = "fix";
              help = "format & fix found issues";
              command = ''
                ${nix.lib.cd_root}
                nix fmt ./*.nix
                ${pkgs.golangci-lint}/bin/golangci-lint run --sort-results --out-format tab --config ${nix.lib.golangci-config-file} --fix --issues-exit-code 0 ./...
                npm --prefix app/frontend run fix
              '';
            }
            {
              name = "update-npm-deps-hash";
              help = "Calculates and updates the npmDepsHash in default.nix";
              command = ''
                ${nix.lib.cd_root}
                echo "Calculating npm deps"
                # STDERR is poluted by the installed nodules, silencing
                HASH=''$(${pkgs.prefetch-npm-deps}/bin/prefetch-npm-deps ''$PRJ_ROOT/app/frontend/package-lock.json 2> /dev/null)
                [[ ''$HASH = sha256* ]] && echo "Hash is ''$HASH"
                [[ ''$HASH != sha256* ]] && echo "Failed" && exit 137

                # Replace the first occurence of npmDepsHash with the new calculated hash in this file
                sed -i "0,/npmDepsHash =/{s@npmDepsHash = .*@npmDepsHash = \"''$HASH\";@}" ./flake.nix
              '';
            }
            {
              name = "dev";
              help = "Starts the javascript project in dev";
              command = ''
                npm --prefix ''$PRJ_ROOT/app/frontend run dev
              '';
            }
          ];
        };
      });
    };
}