{
  description = "Headroom — AGC + compressor + true-peak limiter daemon for PipeWire";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
    rust-overlay = {
      url = "github:oxalica/rust-overlay";
      inputs.nixpkgs.follows = "nixpkgs";
    };
  };

  outputs =
    {
      self,
      nixpkgs,
      rust-overlay,
    }:
    let
      systems = [
        "x86_64-linux"
        "aarch64-linux"
      ];
      forAllSystems = nixpkgs.lib.genAttrs systems;

      pkgsFor =
        system:
        import nixpkgs {
          inherit system;
          overlays = [ rust-overlay.overlays.default ];
        };

      perSystem =
        system:
        let
          pkgs = pkgsFor system;

          rustToolchain = pkgs.rust-bin.fromRustupToolchainFile ./rust-toolchain.toml;

          rustPlatform = pkgs.makeRustPlatform {
            cargo = rustToolchain;
            rustc = rustToolchain;
          };

          # Native libs the audio crates link against.
          nativeAudioBuildInputs = with pkgs; [
            pipewire
            pipewire.dev
          ];

          nativeBuildTools = with pkgs; [
            pkg-config
            clang
          ];

          commonEnv = {
            LIBCLANG_PATH = "${pkgs.libclang.lib}/lib";
            PKG_CONFIG_PATH = "${pkgs.pipewire.dev}/lib/pkgconfig";
          };
        in
        {
          # `nix develop` — full dev environment.
          devShell = pkgs.mkShell (
            {
              name = "headroom-dev";

              nativeBuildInputs = nativeBuildTools ++ [
                rustToolchain
                pkgs.rust-analyzer
              ];

              buildInputs =
                nativeAudioBuildInputs
                ++ (with pkgs; [
                  socat # poke the IPC socket
                  jq # pretty-print JSON
                  pipewire # for pw-cli, pw-cat, etc.
                  wireplumber
                ]);

              shellHook = ''
                echo "headroom dev shell — rustc $(rustc --version | cut -d' ' -f2)"
                echo "  cargo build / cargo test for iteration."
                echo "  nix build  .#headroom  for the packaged binary."
                export RUST_BACKTRACE=1
                export RUST_LOG=headroom=debug,info
              '';
            }
            // commonEnv
          );

          # `nix build` — the final packaged daemon + CLI.
          headroom = rustPlatform.buildRustPackage (
            {
              pname = "headroom";
              # Pull from the workspace Cargo.toml — the per-crate
              # manifests use `version.workspace = true` which evaluates
              # to a table here, not a string.
              version = (builtins.fromTOML (builtins.readFile ./Cargo.toml)).workspace.package.version;

              src = ./.;

              cargoLock = {
                lockFile = ./Cargo.lock;
                # allowBuiltinFetchGit = true;
              };

              nativeBuildInputs = nativeBuildTools;
              buildInputs = nativeAudioBuildInputs;

              # We ship one binary from the workspace: `headroom` (cli + daemon).
              cargoBuildFlags = [
                "-p"
                "headroom-cli"
              ];
              doCheck = true;
              cargoTestFlags = [ "--workspace" ];

              # Install the systemd user unit (templated with @bindir@
              # so the unit refers to the absolute path of the binary in
              # this derivation, never to whatever happens to be on
              # PATH) and ship the canonical profiles under
              # share/headroom/profiles so users / modules can copy
              # them into XDG_CONFIG_HOME on first run.
              postInstall = ''
                install -Dm644 contrib/systemd/headroom.service \
                  "$out/lib/systemd/user/headroom.service"
                substituteInPlace "$out/lib/systemd/user/headroom.service" \
                  --replace-fail '@bindir@' "$out/bin"

                mkdir -p "$out/share/headroom/profiles"
                cp -r profiles/. "$out/share/headroom/profiles/"
              '';

              meta = with pkgs.lib; {
                description = "Audio dynamic range daemon for PipeWire";
                license = licenses.gpl3Plus;
                platforms = platforms.linux;
                mainProgram = "headroom";
              };
            }
            // commonEnv
          );
        };
    in
    {
      devShells = forAllSystems (system: {
        default = (perSystem system).devShell;
      });

      packages = forAllSystems (
        system:
        let
          ps = perSystem system;
        in
        rec {
          default = headroom;
          headroom = ps.headroom;
        }
      );

      formatter = forAllSystems (system: (pkgsFor system).nixpkgs-fmt);

      # System-independent outputs — modules.
      nixosModules.default = import ./nix/nixos-module.nix self;
      homeModules.default = import ./nix/home-module.nix self;
    };
}