{
  description = "Towerops - Phoenix LiveView SNMP monitoring platform";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";

    flake-parts = {
      url = "github:hercules-ci/flake-parts";
      inputs.nixpkgs-lib.follows = "nixpkgs";
    };

    systems.url = "github:nix-systems/default";

    pre-commit-hooks = {
      url = "github:cachix/pre-commit-hooks.nix";
      inputs.nixpkgs.follows = "nixpkgs";
    };
  };

  outputs =
    inputs@{
      self,
      nixpkgs,
      flake-parts,
      systems,
      pre-commit-hooks,
    }:
    flake-parts.lib.mkFlake { inherit inputs; } {
      systems = import systems;

      perSystem =
        {
          config,
          self',
          inputs',
          pkgs,
          system,
          ...
        }:
        {
          _module.args.pkgs = import nixpkgs {
            inherit system;
            config = {
              allowUnfree = true; # Required for towerops (unfree license)
            };
            overlays = [
              # Pin specific Elixir and Erlang versions to match .tool-versions
              # Elixir 1.19.5-otp-28, Erlang 28.3
              (final: prev: {
                # Use Erlang 28 (OTP 28.3)
                erlang = prev.erlang_28;

                # Use Elixir 1.19 with Erlang 28 (1.19.5-otp-28)
                elixir = prev.beam.packages.erlang_28.elixir_1_19;

                # Ensure beam packages use our pinned versions
                # This affects mixRelease and all BEAM-related builds
                beamPackages = prev.beam.packages.erlang_28;
              })
            ];
          };

          packages = {
            # C NIF shared library (cached separately from Elixir code)
            towerops-nif = pkgs.callPackage ./nix/c-nif.nix { };

            # Main Elixir release
            towerops = pkgs.callPackage ./nix/build.nix {
              inherit (self'.packages) towerops-nif;
            };

            # Docker OCI image (pure Nix, no Dockerfile)
            dockerImage = pkgs.callPackage ./nix/docker.nix {
              towerops = self'.packages.towerops;
            };

            # Default package
            default = self'.packages.towerops;
          };

          # Development shell with PostgreSQL, Redis, LSPs, formatters
          devShells.default = pkgs.callPackage ./nix/shell.nix {
            pre-commit-hooks = inputs.pre-commit-hooks.lib.${system};
          };

          # Nix formatter for flake files
          formatter = pkgs.nixfmt;
        };

      flake = {
        # Cachix binary cache configuration
        # Setup instructions:
        #   1. Create cache: cachix create towerops
        #   2. Generate keypair: cachix generate-keypair towerops
        #   3. Get public key: cachix get towerops
        #   4. Add CACHIX_AUTH_TOKEN to GitLab CI/CD variables
        #   5. Update public key below after cache creation
        nixConfig = {
          extra-substituters = [
            "https://cache.nixos.org"
            "https://towerops.cachix.org"
          ];
          extra-trusted-public-keys = [
            "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
            # Replace with your Cachix public key after setup:
            # "towerops.cachix.org-1:YOUR_PUBLIC_KEY_HERE"
          ];
        };
      };
    };
}