{
  description = "Rats with Gats Remote Play Web App";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
    flake-utils.url = "github:numtide/flake-utils";
  };

  outputs = { self, nixpkgs, flake-utils, ... }:
    flake-utils.lib.eachDefaultSystem (system:
      let
        pkgs = nixpkgs.legacyPackages.${system};
        python = pkgs.python3;
        
        # Define the application package
        piratsApp = python.pkgs.buildPythonApplication {
          pname = "pirats";
          version = "0.1.0";
          src = ./.;
          format = "pyproject";

          nativeBuildInputs = with python.pkgs; [
            setuptools
            wheel
          ];

          propagatedBuildInputs = with python.pkgs; [
            fastapi
            sqlmodel
            uvicorn
            jinja2
            python-multipart
          ];

          nativeCheckInputs = with python.pkgs; [
            pytestCheckHook
          ];

          pythonImportsCheck = [ "pirats" ];
        };
      in
      {
        packages.default = piratsApp;
        packages.pirats = piratsApp;

        devShells.default = pkgs.mkShell {
          inputsFrom = [ piratsApp ];
          packages = with pkgs; [
            python.pkgs.pytest
          ];
        };
      }
    ) // {
      # NixOS Module to run the application as a service
      nixosModules.default = { config, lib, pkgs, ... }:
        let
          cfg = config.services.pirats;
        in
        {
          options.services.pirats = {
            enable = lib.mkEnableOption "Rats with Gats remote play service";
            package = lib.mkOption {
              type = lib.types.package;
              default = self.packages.${pkgs.system}.default;
              description = "The pirats package to use.";
            };
            host = lib.mkOption {
              type = lib.types.str;
              default = "127.0.0.1";
              description = "The host address to bind to.";
            };
            port = lib.mkOption {
              type = lib.types.port;
              default = 8000;
              description = "The port to listen on.";
            };
            databasePath = lib.mkOption {
              type = lib.types.str;
              default = "/var/lib/pirats/rats_with_gats.db";
              description = "Path to the SQLite database file.";
            };
            openFirewall = lib.mkOption {
              type = lib.types.bool;
              default = false;
              description = "Open ports in the firewall for the service.";
            };
          };

          config = lib.mkIf cfg.enable {
            networking.firewall.allowedTCPPorts = lib.optionals cfg.openFirewall [ cfg.port ];

            systemd.services.pirats = {
              description = "Rats with Gats Web Application";
              after = [ "network.target" ];
              wantedBy = [ "multi-user.target" ];

              environment = {
                DATABASE_URL = "sqlite:///${cfg.databasePath}";
              };

              serviceConfig = {
                ExecStart = "${cfg.package}/bin/pirats --host ${cfg.host} --port ${toString cfg.port}";
                Restart = "always";
                
                # Sandboxing and security
                DynamicUser = true;
                StateDirectory = "pirats";
                WorkingDirectory = "/var/lib/pirats";
                
                ProtectSystem = "strict";
                ProtectHome = true;
                PrivateTmp = true;
                PrivateDevices = true;
              };
            };
          };
        };
    };
}