{

  # TODO make this usable again! Add sane defaults for inputs, and allow for
  # injecting a bootstrap file.

  pkgs,
  garage,
  selfRev,
  hostSystem,

}: rec {

  inherit garage;

  version = pkgs.stdenv.mkDerivation {
    name = "cryptic-net-version";

    inherit selfRev hostSystem;
    src = ./version.txt;

    garageVersion = garage.version;

    # TODO it'd be nice to be able to call `go version`, but that doesn't work
    # when crossSystem is being used for some unknown reason.
    goVersion = pkgs.go.version;

    builder = builtins.toFile "builder.sh" ''
      source $stdenv/setup

      versionFile=version

      cat "$src" >> "$versionFile"
      echo "" >> "$versionFile"

      echo "System:         $hostSystem"    >> "$versionFile"
      echo "Git Revision:   $selfRev"       >> "$versionFile"
      echo "Go Version:     $goVersion"     >> "$versionFile"
      echo "Garage Version: $garageVersion" >> "$versionFile"

      mkdir -p "$out"/share
      cp "$versionFile" "$out"/share
    '';
  };

  entrypoint = pkgs.callPackage ./entrypoint {};

  dnsmasq = (pkgs.callPackage ./nix/dnsmasq.nix {
    stdenv = pkgs.pkgsStatic.stdenv;
  });

  nebula = pkgs.callPackage ./nix/nebula.nix {};

  appDir = pkgs.buildEnv {
    name = "cryptic-net-AppDir";
    paths = [

      ./AppDir
      version
      dnsmasq
      nebula
      garage
      entrypoint

    ];
  };

  appimagetool = pkgs.callPackage ./nix/appimagetool.nix {};

  appImage = pkgs.stdenv.mkDerivation {
    name = "cryptic-net-AppImage";
    src = appDir;

    nativeBuildInputs = [
      appimagetool
    ];

    ARCH = "x86_64";

    builder = builtins.toFile "build.sh" ''
      source $stdenv/setup
      cp -rL "$src" cryptic-net.AppDir
      chmod +w cryptic-net.AppDir -R

      export VERSION=debug

      # https://github.com/probonopd/go-appimage/issues/155
      unset SOURCE_DATE_EPOCH

      appimagetool ./cryptic-net.AppDir

      mkdir -p "$out"/bin
      chmod +w "$out" -R
      mv Cryptic_Net-* "$out"/bin/cryptic-net
    '';
  };

  release = pkgs.stdenv.mkDerivation {
    name = "cryptic-net-release";
    inherit appImage;

    nativeBuildInputs = [ pkgs.coreutils ];

    builder = builtins.toFile "build.sh" ''
      source $stdenv/setup

      mkdir -p "$out"
      cp "$appImage" "$out"/cryptic-net
      (cd "$out" && sha256sum * > sha256.txt)
    '';
  };
}