{
  description = "atproto starterkit";

  inputs = {
    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
    gomod2nix = {
      url = "github:nix-community/gomod2nix";
      inputs.nixpkgs.follows = "nixpkgs";
    };
  };

  outputs = {
    self,
    nixpkgs,
    gomod2nix,
    ...
  }: let
    supportedSystems = ["x86_64-linux" "x86_64-darwin" "aarch64-linux" "aarch64-darwin"];
    forAllSystems = nixpkgs.lib.genAttrs supportedSystems;
    nixpkgsFor = forAllSystems (system: nixpkgs.legacyPackages.${system});
  in {
    devShells = forAllSystems (system: let
      pkgs = nixpkgsFor.${system};
      staticShell = pkgs.mkShell.override {
        stdenv = pkgs.pkgsStatic.stdenv;
      };
    in {
      default = staticShell {
        nativeBuildInputs = [
          pkgs.go
          pkgs.air
          pkgs.gopls
          pkgs.httpie
          pkgs.litecli
          pkgs.websocat
          pkgs.tailwindcss
          pkgs.nixos-shell
          pkgs.redis
          pkgs.coreutils # for those of us who are on systems that use busybox (alpine)
          gomod2nix.legacyPackages.${system}.gomod2nix
        ];
        shellHook = ''
          export TANGLED_OAUTH_CLIENT_KID="$(date +%s)"
        '';
        env.CGO_ENABLED = 1;
      };
    });

    apps = forAllSystems (system: let
      pkgs = nixpkgsFor."${system}";
    in {
      lexgen = {
        type = "app";
        program =
          (pkgs.writeShellApplication {
            name = "lexgen";
            text = ''
              if ! command -v lexgen > /dev/null; then
                echo "error: must be executed from devshell"
                exit 1
              fi

              rootDir=$(jj --ignore-working-copy root || git rev-parse --show-toplevel) || (echo "error: can't find repo root?"; exit 1)
              cd "$rootDir"

              outdir=api/lexicons

              rm -f $outdir/*
              lexgen --build-file lexicon-build-config.json lexicons
              sed -i.bak 's/\tutil/\/\/\tutil/' $outdir/*
              # lexgen generates incomplete Marshaler/Unmarshaler for union types
              find $outdir/*.go -not -name "cbor_gen.go" -exec \
                sed -i '/^func.*\(MarshalCBOR\|UnmarshalCBOR\)/,/^}/ s/^/\/\/ /' {} +
              ${pkgs.gotools}/bin/goimports -w $outdir/*
              go run ./cmd/cborgen/
              lexgen --build-file lexicon-build-config.json lexicons
              rm $outdir/*.bak
            '';
          })
          + /bin/lexgen;
      };
      gomod2nix = {
        type = "app";
        program = toString (pkgs.writeShellScript "gomod2nix" ''
          ${gomod2nix.legacyPackages.${system}.gomod2nix}/bin/gomod2nix generate --outdir ./nix
        '');
      };
    });
  };
}