{
  description = "CentralCloud unified portal (Elixir/Phoenix umbrella)";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
    flake-utils.url = "github:numtide/flake-utils";
    nix2container = {
      url = "github:nlewo/nix2container";
      inputs.nixpkgs.follows = "nixpkgs";
    };
  };

  nixConfig = {
    extra-substituters = [
      "https://cache.centralcloud.com/default"
    ];
    extra-trusted-public-keys = [
      "default:ywfU21WX06iOn2Ec2lae1jYh4w8LO4IQkmp06vJzsk8="
    ];
  };

  outputs = { self, nixpkgs, flake-utils, nix2container }:
    flake-utils.lib.eachDefaultSystem (system:
      let
        pkgs = nixpkgs.legacyPackages.${system};
        beam = pkgs.beam.packages.erlang_28.extend (_self: super: {
          elixir = super.elixir_1_19.overrideAttrs (_old: {
            version = "1.20.0-rc.4";
            src = pkgs.fetchFromGitHub {
              owner = "elixir-lang";
              repo  = "elixir";
              rev   = "v1.20.0-rc.4";
              hash  = "sha256-sboB+GW3T+t9gEcOGtd6NllmIlyWio1+cgWyyxE+484=";
            };
          });
        });
        n2c = nix2container.packages.${system}.nix2container;

        src = ./.;

        staffRelease = beam.mixRelease rec {
          pname = "centralcloud-staff";
          version = "0.2.1";
          inherit src;

          mixFodDeps = beam.fetchMixDeps {
            pname = "centralcloud-staff-deps";
            inherit src version;
            hash = "sha256-MJGIZPdeK5aVHSJ8ZTPRoxqHKyTA4WYR+uFdmJCpFy4=";
          };

          INCLUDE_ERTS = "false";

          nativeBuildInputs = [
            pkgs.tailwindcss
          ];

          preBuild = ''
            mkdir -p apps/centralcloud_staff/priv/static/assets
            ${pkgs.tailwindcss}/bin/tailwindcss \
              --config apps/centralcloud_staff/assets/tailwind.config.js \
              --input apps/centralcloud_staff/assets/css/app.css \
              --output apps/centralcloud_staff/priv/static/assets/app.css \
              --minify
          '';

          mixReleaseName = "centralcloud_staff";

          postInstall = ''
            chmod +x "$out"/bin/* || true
          '';
        };

        staffImageRoot = pkgs.buildEnv {
          name = "centralcloud-staff-image-root";
          paths = [
            staffRelease
            pkgs.beam.packages.erlang_28.erlang
            pkgs.cacert
            pkgs.bash
            pkgs.coreutils
          ];
          pathsToLink = [
            "/bin"
            "/etc"
          ];
        };

        staffContainer = n2c.buildImage {
          name = "registry.infra.centralcloud.com/centralcloud/centralcloud-staff";
          tag = staffRelease.version;
          copyToRoot = [
            staffImageRoot
          ];
          maxLayers = 32;
          config = {
            Cmd = ["/bin/centralcloud_staff" "start"];
            Env = [
              "HOME=/tmp"
              "PHX_SERVER=true"
              "ELIXIR_ERL_OPTIONS=+fnu"
              "LANG=C.UTF-8"
              "LC_ALL=C.UTF-8"
              "SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt"
            ];
            ExposedPorts = {
              "4000/tcp" = {};
            };
            Labels = {
              "org.opencontainers.image.title" = "CentralCloud Staff";
              "org.opencontainers.image.source" = "https://git.infra.centralcloud.com/centralcloud/portal";
            };
          };
        };

        elixir_1_20_rc4 = beam.elixir;
      in {
        packages.centralcloud-staff = staffRelease;
        packages.container-staff = staffContainer;
        packages.default = staffRelease;

        devShells.default = pkgs.mkShell {
          buildInputs = with pkgs; [
            elixir_1_20_rc4
            pkgs.beam.packages.erlang_28.erlang
            nodejs_22
            inotify-tools
          ];

          shellHook = ''
            export MIX_HOME=$HOME/.mix
            export HEX_HOME=$HOME/.hex
            export PATH=$MIX_HOME/bin:$HEX_HOME/bin:$PATH
            echo "Elixir $(elixir --version | head -1)"
            echo "Mix $(mix --version)"
          '';
        };
      });
}