{
  description = "Example of a Flake using flaky-utils.";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.05";
    flake-utils.url = "github:numtide/flake-utils";
    flaky-utils.url = "git+https://cgit.euxane.net/flaky-utils";
  };

  outputs = { self, nixpkgs, flake-utils, flaky-utils }:
  flake-utils.lib.eachDefaultSystem (system: let
    pkgs = import nixpkgs { inherit system; };
  in pkgs.lib.fold pkgs.lib.recursiveUpdate { } [

    {
      # Convenience development shell providing some tools.
      #
      # The binaries made available and the environment variable set are
      # printed when entering the shell.
      #
      # The user's default shell is used instead of Bash (sacrifying a bit of
      # reproducibility for convenience).
      #
      devShell = flaky-utils.lib.mkDevShell {
        inherit pkgs;

        tools = with pkgs; [
          postgresql_14
          pgcli
        ];

        envVars = rec {
          PGDATA = "$PWD/development_database/pgdata";
          PGHOST = "$PWD/development_database";
          PGPORT = "5432";
          PGDATABASE = "app";
          DATABASE_URL = "postgresql:///${PGDATABASE}?host=${PGHOST}";
        };

        prePrompt = ''
          echo "<C-d> to exit this development shell."
        '';

        shell = null;
      };
    }

    # Convenience isolated environment using a QEMU virtual machine.
    #
    # This defines a triplet of nixosConfiguration, package and app with the
    # given name, so that the virtual machine can be launched using
    # a command like `nix run .#sandbox`.
    #
    # By default, the VM is launched in the current console without a graphical
    # interface, dropping to a shell for the default dummy user within.
    #
    # The binaries made available through the `tools` option and the
    # environment variable set through the `envVars` option are printed when
    # entering the shell.
    #
    # The current working directory from which the Flake is run is mounted and
    # made available within the virtual machine in /mnt. The root filesystem
    # is ephemeral (written to a temporary file in /tmp).
    #
    # The virtual machine's network is isolated by default: it cannot access
    # the Internet nor the host's local network. Ports may nevertheless be
    # forwarded explicitly from host to guest and vice-versa.
    #
    (flaky-utils.lib.mkSandboxSystem {
      inherit pkgs;

      name = "sandbox";
      user = "dummy";

      tools = with pkgs; [
        postgresql
        pgcli
      ];

      envVars = {
        PGDATABASE = "app";
      };

      config = {
        virtualisation.forwardPorts = [
          { from = "host"; host.port = 5432; guest.port = 5432; }  # postgres
        ];

        virtualisation.restrictNetwork = true;  # disallow internet access

        services.postgresql = {
          enable = true;
          enableTCPIP = true;

          authentication = ''
            host all all 0.0.0.0/0 trust
          '';

          initialScript = pkgs.writeText "init.sql" ''
            create role dummy login superuser;
          '';
        };
      };
    })

  ]);
}