{
  description = "filesystem monitor";

  inputs = {
    nixpkgs.url = github:NixOS/nixpkgs/nixos-unstable;
  };

  outputs = { self, nixpkgs }:
    let
      plats = nixpkgs.lib.platforms.unix;
      forAllSystems = fn:
        nixpkgs.lib.genAttrs plats (system:
          fn (import nixpkgs {
            inherit system;
          })
        );
    in
      {
        packages = forAllSystems (pkgs: {
          default = pkgs.stdenv.mkDerivation (finalAttrs: {
            name = "bluetop";
            src = ./.;

            # overridable attributes
            fileSystems = ["/"];
            indexPage = null;

            nativeBuildInputs = with pkgs; [ ldc ];

            postPatch =
              let
                mounts = toString (pkgs.lib.forEach finalAttrs.fileSystems (f: ''"${f}",''));
              in
                ''
                  ${if finalAttrs.indexPage != null
                    then "install -Dm644 ${finalAttrs.indexPage} static/index.html"
                    else ""}
                  sed -E 's:mountpoints = \[.+\];$:mountpoints = \[${mounts}\];:' buildconf.d | tee buildconf.d
                '';

            dontAddPrefix = true;
			enableParallelBuilding = true;
            installFlags = [
              "DESTDIR=$(out)"
              "PREFIX=/"
            ];

            meta.mainProgram = "bluetopd";
          });
        });
        nixosModule = { config, lib, pkgs, ... }:
          with lib;
          let
            cfg = config.services.bluetop;
          in
            {
              options = {
                services.bluetop = {
                  enable = mkEnableOption "bluetop, a status page displaying storage statistics";
                  package = mkPackageOption pkgs "bluetop" { };
                  openFirewall = mkOption {
                    type = types.bool;
                    default = false;
                    description = "Whether to open the bluetop port to the firewall.";
                  };
                  port = mkOption {
                    type = types.port;
                    default = 8089;
                    description = "Port for bluetop to bind to.";
                  };
                };
              };

              config = mkIf cfg.enable {
                users.groups.bluetop = {};
                users.users.bluetop = {
                  description = "bluetop service user";
                  group = "bluetop";
                  isSystemUser = true;
                };

                systemd.services.bluetopd = {
                  after = [ "network.target" ];
                  wantedBy = [ "multi-user.target" ];
                  script = ''
                set -eu
                ${getExe cfg.package} --port ${toString cfg.port}
                  '';
                };

                networking.firewall = mkIf cfg.openFirewall {
                  allowedTCPPorts = [ cfg.port ];
                };
              };
            };
      };
}