{
  description = "Simple Caddy Hello World with custom certificates";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
  };

  outputs = { self, nixpkgs }:
  let
    system = "x86_64-linux";
    pkgs = nixpkgs.legacyPackages.${system};
    did-plc-server = pkgs.callPackage ./packages/did-method-plc.nix { };
    plc = pkgs.callPackage ./packages/plc.nix { inherit did-plc-server; };
    caddy-proxy = pkgs.callPackage ./packages/caddy.nix { };
    pds = pkgs.callPackage ./packages/pds.nix { };
    mailhog = pkgs.callPackage ./packages/mailhog.nix { };
    indigo-relay = pkgs.callPackage ./packages/indigo-relay.nix { };
  in
  {
    packages.${system} = {

      plc = plc;

      caddy-proxy = caddy-proxy;

      pds = pds;

      mailhog = mailhog;

      indigo-relay = indigo-relay;

      # Script to generate certificates on host
      generate-certs = pkgs.writeShellScriptBin "generate-certs" ''
        set -e

        # Create certs directory
        mkdir -p ./certs
        cd ./certs

        echo "Generating certificates with mkcert..."

        # Generate wildcard certificate
        ${pkgs.mkcert}/bin/mkcert \
          -cert-file cert.pem \
          -key-file key.pem \
          localhost \
          127.0.0.1 \
          ::1 \
          pds.example.org \
          plc.example.org \
          relay.example.org

        echo "Certificates generated in ./certs/"
        echo "Files created:"
        ls -la .
      '';

      # Script to start all services in tmux
      all = pkgs.writeShellScriptBin "all" ''
        set -e

        # Check if tmux is available
        if ! command -v tmux >/dev/null 2>&1; then
          echo "❌ tmux is not installed. Please install tmux first."
          exit 1
        fi

        # Check if certificates exist
        if [ ! -f "./certs/cert.pem" ]; then
          echo "⚠️  WARNING: SSL certificates not found. Run 'nix run .#generate-certs' first."
          read -p "Continue anyway? (y/N): " -n 1 -r
          echo
          if [[ ! $REPLY =~ ^[Yy]$ ]]; then
            exit 1
          fi
        fi

        # Check if hosts file is configured
        if ! grep -q "pds.example.org" /etc/hosts 2>/dev/null; then
          echo "⚠️  WARNING: Please add these lines to your /etc/hosts file:"
          echo "   127.0.0.1 pds.example.org"
          echo "   127.0.0.1 plc.example.org"
          echo ""
        fi

        # Kill existing session if it exists
        tmux kill-session -t atproto 2>/dev/null || true

        echo "🚀 Starting AT Protocol services in tmux..."

        # Create new tmux session with PLC server
        tmux new-session -d -s atproto "${plc}/bin/plc"

        # Split vertically for PDS server
        tmux split-window -v -t atproto "${pds}/bin/pds"

        # Split vertically for Caddy proxy
        tmux split-window -v -t atproto "${caddy-proxy}/bin/caddy-proxy"

        # Split vertically for Relay (with environment variables)
        tmux split-window -v -t atproto "
          export RELAY_ADMIN_PASSWORD=password
          export RELAY_PLC_HOST=https://plc.example.org:8444
          export RELAY_TRUSTED_DOMAINS=*.example.org
          export RELAY_ALLOW_INSECURE_HOSTS=true
          export RELAY_LOG_LEVEL=debug
          export RELAY_DISABLE_SSRF=true
          export RELAY_ALLOW_CUSTOM_PORTS=true
          ${indigo-relay}/bin/relay serve
        "


        # Select the first pane
        tmux select-pane -t atproto.0

        echo "✅ Services started in tmux session 'atproto'"
        echo ""
        echo "📋 Available commands:"
        echo "   tmux attach -t atproto       - Attach to the session"
        echo "   tmux kill-session -t atproto - Stop all services"
        echo ""
        echo "📋 Panes layout:"
        echo "   • Pane 0: PLC server"
        echo "   • Pane 1: PDS server"
        echo "   • Pane 2: Caddy proxy" 
        echo "   • Pane 3: AT Protocol Relay"
        echo ""
        echo "💡 Use Ctrl+b followed by arrow keys to switch between panes"
        echo "💡 To monitor firehose: goat firehose --relay-host wss://relay.example.org:8445"
      '';

      # Script to start relay with environment
      relay = pkgs.writeShellScriptBin "relay" ''
        set -e
        
        echo "Starting AT Protocol Relay..."
        echo "Admin password: password"
        echo "PLC host: https://plc.example.org:8444"
        echo ""
        
        # Set relay environment variables
        export RELAY_ADMIN_PASSWORD="password"
        export RELAY_PLC_HOST="https://plc.example.org:8444"
        export RELAY_TRUSTED_DOMAINS="*.example.org"
        export RELAY_ALLOW_INSECURE_HOSTS="true"
        export RELAY_LOG_LEVEL="debug"
        export RELAY_DISABLE_SSRF="true"
        export RELAY_ALLOW_CUSTOM_PORTS="true"
        
        ${indigo-relay}/bin/relay serve
      '';
    };

    # Development shell with tools (no automatic service management)
    devShells.${system}.default = pkgs.mkShell {
      buildInputs = with pkgs; [
        caddy
        mkcert
        curl
        jq
        bluesky-pds
        openssl
        mailhog
        postgresql
        atproto-goat
        tmux
        bash
      ];

      shellHook = ''
        echo "🚀 AT Protocol Development Environment"
        echo ""
        echo "🌐 Services will be available at:"
        echo "   • Bluesky PDS: https://pds.example.org:8443"
        echo "   • DID PLC:     https://plc.example.org:8444"
        echo "   • MailHog:     http://localhost:8025"
        echo ""
        echo "🛠️  Available tools: goat"
        echo ""
        echo "💡 Available packages:"
        echo "   nix run .#all            - Start all services in tmux (recommended)"
        echo "   nix run .#plc            - Start PLC server"
        echo "   nix run .#pds            - Start PDS server"
        echo "   nix run .#caddy-proxy    - Start Caddy proxy"
        echo "   nix run .#relay          - Start AT Protocol Relay"
        echo "   nix run .#mailhog        - Start MailHog"
        echo "   nix run .#generate-certs - Generate SSL certificates"
        echo ""
        echo "🚀 Quick start: nix run .#all"
        echo "ℹ️  Note: You control when services start and stop"
        echo ""
        
        # Set custom prompt
        export PS1='[AT Proto Dev] \u@\h:\w\$ '
      '';
    };
  };
}