{
  description = "Towerops - Phoenix LiveView SNMP monitoring platform";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";

    flake-parts = {
      url = "github:hercules-ci/flake-parts";
      inputs.nixpkgs-lib.follows = "nixpkgs";
    };

    systems.url = "github:nix-systems/default";

    pre-commit-hooks = {
      url = "github:cachix/pre-commit-hooks.nix";
      inputs.nixpkgs.follows = "nixpkgs";
    };
  };

  outputs =
    inputs@{
      self,
      nixpkgs,
      flake-parts,
      systems,
      pre-commit-hooks,
    }:
    flake-parts.lib.mkFlake { inherit inputs; } {
      # nixpkgs 26.11 dropped x86_64-darwin support
      systems = builtins.filter (s: s != "x86_64-darwin") (import systems);

      perSystem =
        {
          config,
          self',
          inputs',
          pkgs,
          system,
          ...
        }:
        {
          _module.args.pkgs = import nixpkgs {
            inherit system;
            config = {
              allowUnfree = true; # Required for towerops (unfree license)
            };
            overlays = [
              # Pin specific Elixir and Erlang versions to match .tool-versions
              # Elixir 1.20.2-otp-29, Erlang 29.0.3
              (final: prev: {
                # Use Erlang 29 (OTP 29.0.3) — no top-level erlang_29 yet, use beam.interpreters
                erlang = prev.beam.interpreters.erlang_29;

                # Use Elixir 1.20 with Erlang 29 (1.20.2-otp-29)
                elixir = prev.beam.packages.erlang_29.elixir_1_20;

                # Ensure beam packages use our pinned versions
                # This affects mixRelease and all BEAM-related builds
                beamPackages = prev.beam.packages.erlang_29.extend (
                  self: super: {
                    elixir = super.elixir_1_20;
                  }
                );
              })
            ];
          };

          packages = {
            # C NIF shared library (cached separately from Elixir code)
            towerops-nif = pkgs.callPackage ./nix/c-nif.nix { };

            # Main Elixir release
            towerops = pkgs.callPackage ./nix/build.nix {
              inherit (self'.packages) towerops-nif;
            };

            # Docker OCI image (pure Nix, no Dockerfile)
            dockerImage = pkgs.callPackage ./nix/docker.nix {
              towerops = self'.packages.towerops;
            };

            # Default package
            default = self'.packages.towerops;
          };

          # Development shell with PostgreSQL, Redis, LSPs, formatters
          devShells.default = pkgs.callPackage ./nix/shell.nix {
            pre-commit-hooks = inputs.pre-commit-hooks.lib.${system};
          };

          # Nix formatter for flake files
          formatter = pkgs.nixfmt;
        };

      flake = {
        # Cachix binary cache configuration
        # Setup instructions:
        #   1. Create cache: cachix create towerops
        #   2. Generate keypair: cachix generate-keypair towerops
        #   3. Get public key: cachix get towerops
        #   4. Add CACHIX_AUTH_TOKEN to GitLab CI/CD variables
        #   5. Update public key below after cache creation
        nixConfig = {
          extra-substituters = [
            "https://cache.nixos.org"
            "https://towerops.cachix.org"
          ];
          extra-trusted-public-keys = [
            "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
            # Replace with your Cachix public key after setup:
            # "towerops.cachix.org-1:YOUR_PUBLIC_KEY_HERE"
          ];
        };
      };
    };
}