{
  description = "Prometheus exporter for the Geekworm X1208 UPS HAT";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
    flake-utils.url = "github:numtide/flake-utils";
  };

  outputs =
    {
      self,
      nixpkgs,
      flake-utils,
    }:
    # This flake exports the PACKAGE only. There is deliberately no
    # nixosModule: the systemd unit carries host policy (device access,
    # groups, polkit, hardening, whether shutdown is enabled at all) and lives
    # in the infrastructure repo. Two sources of unit truth is the split-brain
    # this avoids.
    flake-utils.lib.eachDefaultSystem (
      system:
      let
        pkgs = nixpkgs.legacyPackages.${system};
        version = if self ? rev then "0.0.0+${builtins.substring 0 8 self.rev}" else "dev";
      in
      {
        packages.default = self.packages.${system}.x1208-exporter;

        packages.x1208-exporter = pkgs.buildGoModule {
          pname = "x1208-exporter";
          inherit version;
          src = ./.;
          vendorHash = "sha256-vPzEdZJ3kZ79zl17r2ssFtk3anE21ARy/RRbYqBoiEI=";

          ldflags = [
            "-s"
            "-w"
            "-X main.version=${version}"
          ];

          # The hardware packages need a Pi; the pure ones do not. Only the
          # pure packages carry tests, so the whole suite runs in the sandbox.
          doCheck = true;

          meta = {
            description = "Prometheus textfile exporter for the Geekworm X1208 UPS HAT";
            mainProgram = "x1208-exporter";
            platforms = pkgs.lib.platforms.linux;
          };
        };

        devShells.default = pkgs.mkShell {
          packages = with pkgs; [
            go
            gopls
            golangci-lint
          ];
        };

        formatter = pkgs.nixfmt-rfc-style;
      }
    );
}