{
  description = "Skynet LDAP backend";

  inputs = {
    nixpkgs.url = "nixpkgs/nixos-23.05";
    naersk.url  = "github:nix-community/naersk";
    utils.url   = "github:numtide/flake-utils";
  };

  outputs = { self, nixpkgs, utils, naersk }: utils.lib.eachDefaultSystem (system: 
  let
    pkgs            = nixpkgs.legacyPackages."${system}";
    naersk-lib      = naersk.lib."${system}";
    package_name    = "skynet_ldap_backend";
    package_update  = "update_groups";
    desc            = "Skynet LDAP backend";
  in rec {

    # `nix build`
    packages."${package_name}" = naersk-lib.buildPackage {
      pname = "${package_name}";
      root = ./.;
      
      buildInputs = [
        pkgs.openssl
        pkgs.pkg-config
      ];
    };

    defaultPackage = packages."${package_name}";

    # `nix run`
    apps."${package_name}" = utils.lib.mkApp {
      drv = packages."${package_name}";
    };

    defaultApp = apps."${package_name}";

    # `nix develop`
    devShell = pkgs.mkShell {
      nativeBuildInputs = with pkgs; [ rustc cargo ];
    };
    
    nixosModule = { lib, pkgs, config, ... }: 
      with lib; 
      let
        cfg = config.services."${package_name}";
        enviroment_config = {
          # non secret ldap stuff
          LDAP_HOST       = cfg.ldap.host;
          LDAP_ADMIN      = cfg.ldap.admin;
          
          # basic dserver stuff
          HOME            = cfg.home;
          DATABASE        = "database.db";
          CSV             = "wolves.csv";
          HOST_PORT       = cfg.host_port;
          
          # special categories of users
          USERS_ADMIN     = lib.strings.concatStringsSep "," cfg.users.admin;
          USERS_COMMITTEE = lib.strings.concatStringsSep "," cfg.users.committee;
          USERS_LIFETIME  = lib.strings.concatStringsSep "," cfg.users.lifetime;
          USERS_BANNED    = lib.strings.concatStringsSep "," cfg.users.banned;
        };
      in { 
        options.services."${package_name}" = {
          enable = mkEnableOption "enable ${package_name}";
          
          # keep really secret stuff in this
          envFile = mkOption rec {
            type        = types.str;
            description = "The env file";
          };
          
          ldap = {
            host = mkOption rec {
              type        = types.str;
              description = "LDAP Host";
            };
            
            admin = mkOption rec {
              type        = types.str;
              description = "LDAP admin account dn";
            };
          };
          
          users = {
            admin = mkOption rec {
              type        = types.listOf types.str;
              default     = [];
              description = "array of admins";
            };
            committee = mkOption rec {
              type        = types.listOf types.str;
              default     = [];
              description = "array of committee members";
            };
            lifetime = mkOption rec {
              type        = types.listOf types.str;
              default     = [];
              description = "array of lifetime users";
            };
            banned = mkOption rec {
              type        = types.listOf types.str;
              default     = [];
              description = "array of banned users";
            };
          };
          
          host_port = mkOption rec {
            type        = types.str;
            default     = "127.0.0.1:8087";
            description = "host/port for teh server tro run on";
          };
          
          # specific for teh program running
          user = mkOption rec {
            type        = types.str;
            default     = "${package_name}";
            description = "The user to run the service";
          };
           
          home = mkOption rec {
            type        = types.str;
            default     = "/etc/skynet_${package_name}";
            description = "The home for the user";
          };
            
        };

        config = mkIf cfg.enable {
        
          users.groups."${cfg.user}" = { };
          
          users.users."${cfg.user}" = {
            createHome    = true;
            isSystemUser  = true;
            home          = "${cfg.home}";
            group         = "${cfg.user}";
          };
          
          systemd.services."${cfg.user}" = {
            description = desc;
            wantedBy    = [ "multi-user.target" ];
            after       = [ "network-online.target" ];
            wants       = [ ];
            environment = enviroment_config;
            
            serviceConfig = {
              # because we are storing data we need a home for it
              User            = "${cfg.user}";
              Group           = "${cfg.user}";
              Restart         = "always";
              ExecStart       = "${self.defaultPackage."${system}"}/bin/${package_name}";
              EnvironmentFile = "${cfg.envFile}";
            };
          };
          
          # for updating the data
          systemd.services."${cfg.user}_update" = {
            description = "${desc} Update groups";
            wantedBy    = [ ];
            after       = [ "network-online.target" ];
            environment = enviroment_config;
            
            serviceConfig = {
              Type            = "oneshot";
              DynamicUser     = true;
              ExecStart       = "${self.defaultPackage."${system}"}/bin/${package_update}";
              EnvironmentFile = "${cfg.envFile}";
            };
          };
           
          systemd.timers."${cfg.user}_update" = {
            description = "Run the update script for ${desc}";
            
            wantedBy    = [ "timers.target" ];
            partOf      = [ "${cfg.user}_update.service" ];
            timerConfig = {
              # every hour
              OnCalendar  = "*-*-* *:00:00";
              Unit        = "${cfg.user}_update.service";
            };
          };
          
        };
        
      };
    
  });
}