{

  buildSystem ? builtins.currentSystem,
  hostSystem ? buildSystem,
  pkgsNix ? (import ./nix/pkgs.nix),

  revision ? "dev",
  releaseName ? "dev",

  bootstrap ? null,

}: let

  pkgs = pkgsNix.default {
    inherit buildSystem hostSystem;
  };

  pkgsNative = pkgsNix.default {
    inherit buildSystem;
    hostSystem = buildSystem;
  };

  garageNix = (import ./nix/garage.nix);

in rec {

  version = pkgs.stdenv.mkDerivation {
    name = "isle-version";

    inherit buildSystem hostSystem revision releaseName;

    nativeBuildInputs = [ pkgsNative.git ];

    goVersion = pkgs.go.version;
    garageVersion = garageNix.version;
    nixpkgsVersion = pkgsNix.version;

    builder = builtins.toFile "builder.sh" ''
      source $stdenv/setup

      versionFile=version

      echo "Release:         $releaseName"    >> "$versionFile"
      echo "Platform:        $hostSystem"     >> "$versionFile"
      echo "Git Revision:    $revision"       >> "$versionFile"
      echo "Go Version:      $goVersion"      >> "$versionFile"
      echo "Garage Version:  $garageVersion"  >> "$versionFile"
      echo "NixPkgs Version: $nixpkgsVersion" >> "$versionFile"
      echo "Build Platform:  $buildSystem"    >> "$versionFile"

      mkdir -p "$out"/share
      cp "$versionFile" "$out"/share
    '';
  };

  goBinaries = pkgs.buildGoModule {
    pname = "isle-go-binaries";
    version = "unstable";

    # If this seems pointless, that's because it is! buildGoModule doesn't like
    # it if the src derivation's name ends in "-go". So this mkDerivation here
    # only serves to give buildGoModule a src derivation with a name it likes.
    src = pkgs.stdenv.mkDerivation {
      name = "isle-go-src";
      src = ./go;
      builder = builtins.toFile "builder.sh" ''
        source $stdenv/setup
        cp -r "$src" "$out"
      '';
    };

    vendorSha256 = "sha256-P1TXG0fG8/6n37LmM5ApYctqoZzJFlvFAO2Zl85SVvk=";

    subPackages = [
      "./cmd/entrypoint"
    ];
  };

  dnsmasq = (pkgs.callPackage ./nix/dnsmasq.nix {
    stdenv = pkgs.pkgsStatic.stdenv;
  });

  nebula = pkgs.callPackage ./nix/nebula.nix {};

  garage = let

    hostPlatform = pkgs.stdenv.hostPlatform.parsed;

  in pkgs.callPackage garageNix.package {

    inherit buildSystem;
    hostSystem = "${hostPlatform.cpu.name}-unknown-${hostPlatform.kernel.name}-musl";
    pkgsSrc = pkgsNix.src;

  };

  rootedBootstrap = pkgs.stdenv.mkDerivation {
    name = "isle-rooted-bootstrap";

    src = bootstrap;

    builder = builtins.toFile "builder.sh" ''
      source $stdenv/setup
      mkdir -p "$out"/share
      cp "$src" "$out"/share/bootstrap.yml
    '';
  };

  appDir = pkgs.stdenv.mkDerivation {
    name = "isle-AppDir";

    src = pkgs.buildEnv {
      name = "isle-AppDir-base";
      paths = [

        ./AppDir
        version
        dnsmasq
        nebula
        garage
        pkgs.minio-client
        goBinaries

      ] ++ (if bootstrap != null then [ rootedBootstrap ] else []);
    };

    builder = builtins.toFile "build.sh" ''
      source $stdenv/setup
      cp -rL "$src" "$out"
      chmod +w "$out" -R

      cd "$out"
      cp ./bin/entrypoint ./AppRun
    '';
  };

  appimagetool = pkgs.callPackage ./nix/appimagetool.nix {};

  appImage = pkgs.stdenv.mkDerivation {
    name = "isle-AppImage";
    src = appDir;

    nativeBuildInputs = [
      appimagetool
    ];

    ARCH = pkgs.stdenv.hostPlatform.parsed.cpu.name;

    builder = builtins.toFile "build.sh" ''
      source $stdenv/setup
      cp -rL "$src" isle.AppDir
      chmod +w isle.AppDir -R

      export VERSION=debug

      # https://github.com/probonopd/go-appimage/issues/155
      unset SOURCE_DATE_EPOCH

      appimagetool ./isle.AppDir

      mkdir -p "$out"/bin
      chmod +w "$out" -R
      mv Isle-* "$out"/bin/isle
    '';
  };

  tests = pkgs.writeScript "isle-tests" ''
    export PATH=${pkgs.lib.makeBinPath [
      appImage
      pkgs.busybox
      pkgs.yq-go
      pkgs.jq
      pkgs.dig
    ]}
    export SHELL=${pkgs.bash}/bin/bash
    exec ${pkgs.bash}/bin/bash ${./tests}/entrypoint.sh "$@"
  '';
}