{
  description = "Docker registry frontend & basic library";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";

    crane = {
      url = "github:ipetkov/crane";
      inputs.nixpkgs.follows = "nixpkgs";
    };

    flake-utils.url = "github:numtide/flake-utils";

    Xess.url = "github:Xe/Xess";

    advisory-db = {
      url = "github:rustsec/advisory-db";
      flake = false;
    };
  };

  outputs = { self, nixpkgs, crane, flake-utils, Xess, advisory-db, ... }:
    flake-utils.lib.eachSystem [ "x86_64-linux" "aarch64-linux" ] (system:
      let
        pkgs = import nixpkgs {
          inherit system;
        };

        inherit (pkgs) lib;

        craneLib = crane.lib.${system};
        src = craneLib.cleanCargoSource (craneLib.path ./.);
        commonArgs = {
          inherit src;

          buildInputs = [
            pkgs.openssl
            pkgs.pkg-config
          ] ++ pkgs.lib.optionals pkgs.stdenv.isDarwin [
            pkgs.libiconv
          ];
        };

        cargoArtifacts = craneLib.buildDepsOnly commonArgs;

        dref = craneLib.buildPackage (commonArgs // {
          inherit cargoArtifacts;
        });

        dockerImage = pkgs.dockerTools.buildImage {
          name = "dref";
          config = {
            Cmd = [ "${dref}/bin/dref" ];
            ExposedPorts = {
              "3000/tcp" = {};
            };
          };
        };
      in
      {
        checks = {
          inherit dref;
          dref-clippy = craneLib.cargoClippy (commonArgs // {
            inherit cargoArtifacts;
            cargoClippyExtraArgs = "--all-targets -- --deny warnings";
          });

          dref-doc = craneLib.cargoDoc (commonArgs // {
            inherit cargoArtifacts;
          });

          dref-fmt = craneLib.cargoFmt {
            inherit src;
          };

          dref-audit = craneLib.cargoAudit {
            inherit src advisory-db;
          };

          # Run tests with cargo-nextest
          # Consider setting `doCheck = false` on `dref` if you do not want
          # the tests to run twice
          dref-nextest = craneLib.cargoNextest (commonArgs // {
            inherit cargoArtifacts;
            partitions = 1;
            partitionType = "count";
          });
        };

        apps.default = flake-utils.lib.mkApp {
          drv = dref;
        };

        packages = rec {
          bin = dref;
          docker = dockerImage;
          default = pkgs.symlinkJoin {
            name = "dref-${bin.version}";
            paths = [ bin ];
          };
        };

        defaultPackage = self.packages.${system}.bin;

        devShells.default = pkgs.mkShell {
          inputsFrom = builtins.attrValues self.checks;

          # Extra inputs can be added here
          nativeBuildInputs = with pkgs; [
            cargo
            rustc
            rust-analyzer
            openssl
            pkg-config
          ];
        };
      });
}