{
  description = "Crypto alert Telegram bot that monitors Bybit prices";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
    flake-utils.url = "github:numtide/flake-utils";
  };

  outputs = { self, nixpkgs, flake-utils }:
    flake-utils.lib.eachDefaultSystem (system:
      let
        pkgs = nixpkgs.legacyPackages.${system};
      in
      {
        packages.default = pkgs.buildGoModule {
          pname = "crypto-alert-bot";
          version = "0.1.0";
          src = ./.;

          vendorHash = "sha256-toXJCeMHa61YCFIYtsTl4dime015AF5LlB62QmYVaA8=";

          subPackages = [ "cmd/app" ];

          meta = with pkgs.lib; {
            description = "Telegram bot for Bybit cryptocurrency price alerts";
            mainProgram = "app";
          };
        };

        devShells.default = pkgs.mkShell {
          packages = with pkgs; [
            go
            gopls
            gotools
            golangci-lint
            go-migrate  # provides the `migrate` CLI
          ];
          shellHook = ''
            echo "crypto-alert-bot dev shell"
            echo "  Run: CONFIG_PATH=./internal/config/local.yml go run ./cmd/app/main.go"
          '';
        };
      }
    ) // {
      # NixOS module — import this in your NixOS config to run the bot as a service.
      #
      # The module manages PostgreSQL automatically (creates the DB and user,
      # connects via Unix socket with peer auth). The only settings you must
      # provide are the Telegram token file and optionally log/provider tuning.
      #
      # Minimal example:
      #   services.crypto-alert-bot = {
      #     enable = true;
      #     telegramTokenFile = "/run/secrets/telegram-token";
      #   };
      nixosModules.default = { config, lib, pkgs, ... }:
        with lib;
        let
          cfg = config.services.crypto-alert-bot;
          svcUser = "crypto-alert-bot";

          # The config YAML is fully static (no secrets); the Telegram token is
          # read from a file at ExecStartPre time and written into a per-run copy.
          staticConfig = pkgs.writeText "crypto-alert-bot-base.yml" ''
            logger:
              service_name: "${cfg.logServiceName}"
              encoding: "${cfg.logEncoding}"
              level: "${cfg.logLevel}"
            postgresql:
              address: "/run/postgresql"
              user: "${svcUser}"
              db_name: "${cfg.dbName}"
            telegram:
              token: "__TELEGRAM_TOKEN__"
            providers:
              bybit:
                base_url: "${cfg.bybitBaseUrl}"
          '';

          # Runs as root (+ prefix) before the main process. Copies the static
          # config into the runtime directory and splices in the Telegram token.
          configSetupScript = pkgs.writeShellScript "crypto-alert-bot-setup-config" ''
            set -euo pipefail
            token=$(< ${lib.escapeShellArg cfg.telegramTokenFile})
            install -m 600 -o ${svcUser} ${staticConfig} /run/crypto-alert-bot/config.yml
            sed -i "s|__TELEGRAM_TOKEN__|$token|" /run/crypto-alert-bot/config.yml
          '';
        in
        {
          options.services.crypto-alert-bot = {
            enable = mkEnableOption "crypto alert bot";

            package = mkOption {
              type = types.package;
              default = self.packages.${pkgs.system}.default;
              defaultText = literalExpression "self.packages.\${system}.default";
              description = "The crypto-alert-bot package to use.";
            };

            dbName = mkOption {
              type = types.str;
              default = svcUser;
              description = "PostgreSQL database name (created automatically).";
            };

            telegramTokenFile = mkOption {
              type = types.path;
              description = "Path to a file containing the Telegram bot token (e.g. managed by agenix or sops-nix).";
            };

            logServiceName = mkOption {
              type = types.str;
              default = "alert-bot";
              description = "Service name printed in log lines.";
            };

            logEncoding = mkOption {
              type = types.enum [ "console" "json" ];
              default = "json";
              description = "Log output encoding.";
            };

            logLevel = mkOption {
              type = types.enum [ "debug" "info" "warn" "error" ];
              default = "info";
              description = "Minimum log level.";
            };

            bybitBaseUrl = mkOption {
              type = types.str;
              default = "https://api.bybit.com";
              description = "Bybit REST API base URL.";
            };
          };

          config = mkIf cfg.enable {
            # Create a stable system user whose name matches the PostgreSQL role
            # so that peer (Unix socket) authentication works without a password.
            users.users.${svcUser} = {
              isSystemUser = true;
              group = svcUser;
              description = "Crypto alert bot service user";
            };
            users.groups.${svcUser} = {};

            # Provision the database and role automatically.
            services.postgresql = {
              enable = true;
              ensureDatabases = [ cfg.dbName ];
              ensureUsers = [{
                name = svcUser;
                ensureDBOwnership = true;
              }];
            };

            systemd.services.crypto-alert-bot = {
              description = "Crypto Alert Telegram Bot";
              wantedBy = [ "multi-user.target" ];
              after = [ "network.target" "postgresql.service" ];
              requires = [ "postgresql.service" ];

              serviceConfig = {
                # '+' prefix → root, so we can write to the RuntimeDirectory
                # before switching to the unprivileged service user.
                ExecStartPre = "+${configSetupScript}";
                ExecStart = "${cfg.package}/bin/app";
                Environment = "CONFIG_PATH=/run/crypto-alert-bot/config.yml";

                User = svcUser;
                Group = svcUser;

                RuntimeDirectory = "crypto-alert-bot";
                RuntimeDirectoryMode = "0700";

                Restart = "on-failure";
                RestartSec = "5s";

                NoNewPrivileges = true;
                PrivateTmp = true;
                ProtectSystem = "strict";
                ProtectHome = true;
              };
            };
          };
        };
    };
}