{
  description = "nixos-router: a NixOS-based distribution for routers/firewalls";

  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";

  outputs = { self, nixpkgs }:
    let
      systems = [ "x86_64-linux" "aarch64-linux" ];
      forAllSystems = f: nixpkgs.lib.genAttrs systems (system: f nixpkgs.legacyPackages.${system});
    in
    {
      nixosModules = {
        router = ./modules/router;
        default = self.nixosModules.router;
      };

      # VM tests need KVM; only wired up for x86_64 until aarch64 CI exists.
      checks.x86_64-linux = import ./tests {
        inherit self;
        pkgs = nixpkgs.legacyPackages.x86_64-linux;
      };

      # `nix run .#lab`: boot the basic test topology in tmux, one console pane
      # per VM plus the interactive test-driver REPL.
      apps.x86_64-linux.lab =
        let
          pkgs = nixpkgs.legacyPackages.x86_64-linux;
          test = self.checks.x86_64-linux.basic;
          lab = pkgs.writeShellApplication {
            name = "router-lab";
            runtimeInputs = with pkgs; [ tmux util-linux gnugrep coreutils ];
            text = import ./tests/lab.nix {
              inherit (pkgs) lib;
              driver = test.driverInteractive;
              nodes = builtins.attrNames test.nodes;
            };
          };
        in
        {
          type = "app";
          program = "${lab}/bin/router-lab";
        };

      formatter = forAllSystems (pkgs: pkgs.nixfmt-rfc-style);
    };
}