{
  description = "iknowyou: self-hosted OSINT aggregation platform";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";

    bun2nix = {
      url = "github:nix-community/bun2nix";
      inputs.nixpkgs.follows = "nixpkgs";
    };

    nur-osint = {
      url = "github:anotherhadi/nur-osint";
      inputs.nixpkgs.follows = "nixpkgs";
    };
  };

  outputs = {
    self,
    nixpkgs,
    bun2nix,
    nur-osint,
  }: let
    system = "x86_64-linux";
    pkgs = import nixpkgs {
      inherit system;
      config.permittedInsecurePackages = ["python3.13-pypdf2-3.0.1"];
    };

    backendPkg = import ./nix/backend.nix {inherit pkgs;};
    frontendPkg = import ./nix/frontend.nix {inherit pkgs bun2nix system;};

    osintTools = with pkgs; [
      whois
      dnsutils
      maigret
      nur-osint.packages.${system}.user-scanner
      nur-osint.packages.${system}.github-recon
    ];

    ikyPkg = pkgs.symlinkJoin {
      name = "iky";
      paths = [backendPkg] ++ osintTools;
      nativeBuildInputs = [pkgs.makeWrapper];
      postBuild = ''
        mkdir -p $out/share/iky
        cp -r ${frontendPkg} $out/share/iky/frontend
        wrapProgram $out/bin/server \
          --set-default IKY_FRONT_DIR $out/share/iky/frontend
      '';
    };
  in {
    nixosModules.default = import ./nix/module.nix;

    packages.${system} = {
      backend = backendPkg;
      frontend = frontendPkg;
      default = ikyPkg;
    };

    devShells.${system}.default = pkgs.mkShell {
      packages = with pkgs;
        [
          bun2nix.packages.${system}.default
          bun
          go
          air
          just
        ]
        ++ osintTools;
      IKY_CONFIG = "./config.yaml";
    };
  };
}