{
  description = "Headroom — AGC + compressor + true-peak limiter daemon for PipeWire";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
    flake-utils.url = "github:numtide/flake-utils";
    rust-overlay = {
      url = "github:oxalica/rust-overlay";
      inputs.nixpkgs.follows = "nixpkgs";
    };
  };

  outputs = { self, nixpkgs, flake-utils, rust-overlay }:
    flake-utils.lib.eachSystem [ "x86_64-linux" "aarch64-linux" ] (system:
      let
        pkgs = import nixpkgs {
          inherit system;
          overlays = [ rust-overlay.overlays.default ];
        };

        rustToolchain = pkgs.rust-bin.fromRustupToolchainFile ./rust-toolchain.toml;

        rustPlatform = pkgs.makeRustPlatform {
          cargo = rustToolchain;
          rustc = rustToolchain;
        };

        # Native libs the audio crates link against.
        nativeAudioBuildInputs = with pkgs; [
          pipewire
          pipewire.dev
        ];

        nativeBuildTools = with pkgs; [
          pkg-config
          clang
        ];

        commonEnv = {
          LIBCLANG_PATH = "${pkgs.libclang.lib}/lib";
          PKG_CONFIG_PATH = "${pkgs.pipewire.dev}/lib/pkgconfig";
        };
      in
      {
        # `nix develop` — full dev environment.
        devShells.default = pkgs.mkShell ({
          name = "headroom-dev";

          nativeBuildInputs = nativeBuildTools ++ [
            rustToolchain
            pkgs.rust-analyzer
          ];

          buildInputs = nativeAudioBuildInputs ++ (with pkgs; [
            socat       # poke the IPC socket
            jq          # pretty-print JSON
            pipewire    # for pw-cli, pw-cat, etc.
            wireplumber
          ]);

          shellHook = ''
            echo "headroom dev shell — rustc $(rustc --version | cut -d' ' -f2)"
            echo "  cargo build / cargo test for iteration."
            echo "  nix build  .#headroom  for the packaged binary."
            export RUST_BACKTRACE=1
            export RUST_LOG=headroom=debug,info
          '';
        } // commonEnv);

        # `nix build` — the final packaged daemon + CLI.
        packages = rec {
          default = headroom;

          headroom = rustPlatform.buildRustPackage ({
            pname = "headroom";
            version = (builtins.fromTOML (builtins.readFile ./crates/headroom-cli/Cargo.toml)).package.version;

            src = ./.;

            cargoLock = {
              lockFile = ./Cargo.lock;
              # allowBuiltinFetchGit = true;
            };

            nativeBuildInputs = nativeBuildTools;
            buildInputs = nativeAudioBuildInputs;

            # We ship two binaries from the workspace: `headroom` (cli + daemon).
            cargoBuildFlags = [ "-p" "headroom-cli" ];
            doCheck = true;
            cargoTestFlags = [ "--workspace" ];

            meta = with pkgs.lib; {
              description = "AGC + compressor + true-peak limiter daemon for PipeWire";
              license = licenses.gpl3Plus;
              platforms = platforms.linux;
              mainProgram = "headroom";
            };
          } // commonEnv);
        };

        # Reserved for the eventual user-service module.
        # nixosModules.default = import ./nix/module.nix;

        formatter = pkgs.nixpkgs-fmt;
      });
}