{
  description = "Effigenix ERP – Dev Environment";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
    flake-utils.url = "github:numtide/flake-utils";
    rust-overlay = {
      url = "github:oxalica/rust-overlay";
      inputs.nixpkgs.follows = "nixpkgs";
    };
  };

  outputs = { nixpkgs, flake-utils, rust-overlay, ... }:
    flake-utils.lib.eachDefaultSystem (system:
      let
        overlays = [ (import rust-overlay) ];
        pkgs = import nixpkgs {
          inherit system overlays;
          config = {
            allowUnfree = true;
            android_sdk.accept_license = true;
          };
        };

        rustToolchain = pkgs.rust-bin.stable.latest.default.override {
          extensions = [ "rust-src" "rust-analyzer" ];
          targets = [
            "aarch64-linux-android"
            "armv7-linux-androideabi"
            "i686-linux-android"
            "x86_64-linux-android"
          ];
        };

        # ─── Android SDK ──────────────────────────
        androidComposition = pkgs.androidenv.composeAndroidPackages {
          cmdLineToolsVersion = "8.0";
          platformToolsVersion = "35.0.1";
          buildToolsVersions = [ "34.0.0" "35.0.0" ];
          platformVersions = [ "34" "36" ];
          abiVersions = [ "x86_64" ];
          includeNDK = true;
          ndkVersions = [ "27.0.12077973" ];
          includeSystemImages = true;
          systemImageTypes = [ "google_apis_playstore" ];
          includeEmulator = true;
          useGoogleAPIs = true;
        };
        androidSdk = androidComposition.androidsdk;
        androidHome = "${androidSdk}/libexec/android-sdk";
      in
      {
        devShells.default = pkgs.mkShell {
          name = "effigenix";

          buildInputs = with pkgs; [
            # ─── Frontend ───────────────────────────
            nodejs_22
            nodePackages.pnpm

            # ─── Rust / Tauri ───────────────────────
            rustToolchain
            cargo-tauri

            # Tauri v2 system deps (Linux/GTK)
            pkg-config
            openssl
            gtk3
            webkitgtk_4_1
            libsoup_3
            glib
            gdk-pixbuf
            cairo
            pango
            harfbuzz
            atk

            # ─── Backend ─────────────────────────
            jdk21

            # ─── Android ───────────────────────────
            androidSdk
            jdk17

            # ─── Tools ─────────────────────────────
            just
            jq
            curl
            postgresql
            rainfrog
          ];

          # Tauri braucht diese zur Laufzeit
          LD_LIBRARY_PATH = pkgs.lib.makeLibraryPath (with pkgs; [
            gtk3
            webkitgtk_4_1
            libsoup_3
            openssl
          ]);

          ANDROID_HOME = androidHome;
          ANDROID_SDK_ROOT = androidHome;
          ANDROID_NDK_ROOT = "${androidHome}/ndk/27.0.12077973";
          JAVA_HOME = "${pkgs.jdk21}";

          # NixOS: Gradle's aapt2 von Maven ist dynamisch gelinkt und läuft nicht.
          # Wir zeigen auf das aapt2 aus den Nix-bereitgestellten build-tools.
          GRADLE_OPTS = "-Dandroid.aapt2FromMavenOverride=${androidHome}/build-tools/35.0.0/aapt2";

          shellHook = ''
            echo "Node    $(node --version)"
            echo "pnpm    $(pnpm --version)"
            echo "rustc   $(rustc --version)"
            echo "cargo   $(cargo --version)"
            echo "Java    $(java --version 2>&1 | head -1)"
            echo ""
            echo "ANDROID_HOME=$ANDROID_HOME"
            echo ""
            echo "just --list  für alle Befehle"

            # Tauri mobile dev: Ports 1420 (Vite) + 1421 (HMR) in der NixOS-Firewall öffnen
            if [[ "''${EFFIGENIX_OPEN_FW:-}" == "1" ]]; then
              echo ""
              echo "Opening firewall ports 1420/1421 for Tauri mobile dev..."
              sudo iptables -C nixos-fw -p tcp --dport 1420 -j ACCEPT 2>/dev/null \
                || sudo iptables -I nixos-fw 3 -p tcp --dport 1420 -j ACCEPT
              sudo iptables -C nixos-fw -p tcp --dport 1421 -j ACCEPT 2>/dev/null \
                || sudo iptables -I nixos-fw 3 -p tcp --dport 1421 -j ACCEPT
              echo "Done."
            fi
          '';
        };
      });
}