{

  buildSystem ? builtins.currentSystem,
  hostSystem ? buildSystem,
  pkgsNix ? (import ./nix/pkgs.nix),

  revision ? "",
  releaseName ? "dev",

  bootstrap ? null,

}: let

  pkgs = pkgsNix.default {
    inherit buildSystem hostSystem;
  };

  pkgsNative = pkgsNix.default {
    inherit buildSystem;
    hostSystem = buildSystem;
  };

  garageNix = (import ./nix/garage.nix);

in rec {

  version = pkgs.stdenv.mkDerivation {
    name = "cryptic-net-version";

    inherit buildSystem hostSystem revision releaseName;
    repoSrc = ./.;

    nativeBuildInputs = [ pkgsNative.git ];

    goVersion = pkgs.go.version;
    garageVersion = garageNix.version;
    nixpkgsVersion = pkgsNix.version;

    builder = builtins.toFile "builder.sh" ''
      source $stdenv/setup

      versionFile=version

      if [ "$revision" = "" ]; then
        cp -r "$repoSrc" repoSrcCp
        revision="$(cd repoSrcCp && git rev-parse HEAD)"
      fi

      echo "Release:         $releaseName"    >> "$versionFile"
      echo "Platform:        $hostSystem"     >> "$versionFile"
      echo "Git Revision:    $revision"       >> "$versionFile"
      echo "Go Version:      $goVersion"      >> "$versionFile"
      echo "Garage Version:  $garageVersion"  >> "$versionFile"
      echo "NixPkgs Version: $nixpkgsVersion" >> "$versionFile"
      echo "Build Platform:  $buildSystem"    >> "$versionFile"

      mkdir -p "$out"/share
      cp "$versionFile" "$out"/share
    '';
  };

  entrypoint = pkgs.callPackage ./entrypoint {};

  dnsmasq = (pkgs.callPackage ./nix/dnsmasq.nix {
    stdenv = pkgs.pkgsStatic.stdenv;
  });

  nebula = pkgs.callPackage ./nix/nebula.nix {};

  garage = let

    hostPlatform = pkgs.stdenv.hostPlatform.parsed;

  in pkgs.callPackage garageNix.package {

    inherit buildSystem;
    hostSystem = "${hostPlatform.cpu.name}-unknown-${hostPlatform.kernel.name}-musl";
    pkgsSrc = pkgsNix.src;

  };

  rootedBootstrap = pkgs.stdenv.mkDerivation {
    name = "cryptic-net-rooted-bootstrap";

    src = bootstrap;

    builder = builtins.toFile "builder.sh" ''
      source $stdenv/setup
      mkdir -p "$out"/share
      cp "$src" "$out"/share/bootstrap.yml
    '';
  };

  appDir = pkgs.stdenv.mkDerivation {
    name = "cryptic-net-AppDir";

    src = pkgs.buildEnv {
      name = "cryptic-net-AppDir-base";
      paths = [

        ./AppDir
        version
        dnsmasq
        nebula
        garage
        pkgs.minio-client
        entrypoint

      ] ++ (if bootstrap != null then [ rootedBootstrap ] else []);
    };

    builder = builtins.toFile "build.sh" ''
      source $stdenv/setup
      cp -rL "$src" "$out"
      chmod +w "$out" -R

      cd "$out"
      cp ./bin/entrypoint ./AppRun
    '';
  };

  appimagetool = pkgs.callPackage ./nix/appimagetool.nix {};

  appImage = pkgs.stdenv.mkDerivation {
    name = "cryptic-net-AppImage";
    src = appDir;

    nativeBuildInputs = [
      appimagetool
    ];

    ARCH = pkgs.stdenv.hostPlatform.parsed.cpu.name;

    builder = builtins.toFile "build.sh" ''
      source $stdenv/setup
      cp -rL "$src" cryptic-net.AppDir
      chmod +w cryptic-net.AppDir -R

      export VERSION=debug

      # https://github.com/probonopd/go-appimage/issues/155
      unset SOURCE_DATE_EPOCH

      appimagetool ./cryptic-net.AppDir

      mkdir -p "$out"/bin
      chmod +w "$out" -R
      mv Cryptic_Net-* "$out"/bin/cryptic-net
    '';
  };
}