{
  lib,
  stdenvNoCC,
  fetchurl,
  makeWrapper,
  bash,
  python3,
  podman,
  podman-compose,
  curl,
  coreutils,
  gnugrep,
  gnused,
  gawk,
  findutils,
  zip,
  unzip,
  git,
  util-linux,
  openssh,
}:

let
  # Tools panelctl shells out to. They are appended to PATH, so the host's own
  # versions (e.g. the system podman) still take precedence when present.
  runtimeDeps = [
    podman
    podman-compose
    curl
    coreutils
    gnugrep
    gnused
    gawk
    findutils
    zip
    unzip
    git
    util-linux # flock, used to serialise routes file writes
    openssh # cloning repositories over ssh with the panel's deploy key
  ];

  # PyYAML lets the panel suggest services and ports from compose files.
  python = python3.withPackages (ps: [ ps.pyyaml ]);

  # xterm.js for the web terminal, served by the panel itself (no CDN at runtime).
  xterm = fetchurl {
    url = "https://registry.npmjs.org/@xterm/xterm/-/xterm-6.0.0.tgz";
    hash = "sha512-TQwDdQGtwwDt+2cgKDLn0IRaSxYu1tSUjgKarSDkUM0ZNiSRXFpjxEsvc/Zgc5kq5omJ+V0a8/kIM2WD3sMOYg==";
  };
  xtermFit = fetchurl {
    url = "https://registry.npmjs.org/@xterm/addon-fit/-/addon-fit-0.11.0.tgz";
    hash = "sha512-jYcgT6xtVYhnhgxh3QgYDnnNMYTcf8ElbxxFzX0IZo+vabQqSPAjC3c1wJrKB5E19VwQei89QCiZZP86DCPF7g==";
  };
in
stdenvNoCC.mkDerivation {
  pname = "reudy-panel";
  version = "0.2.0";

  src = lib.fileset.toSource {
    root = ../.;
    fileset = lib.fileset.unions [
      ../panel-api.py
      ../panelctl.sh
      ../frontend
    ];
  };

  nativeBuildInputs = [ makeWrapper ];
  buildInputs = [ bash ];

  dontConfigure = true;
  dontBuild = true;

  installPhase = ''
    runHook preInstall

    install -Dm644 panel-api.py $out/share/panel/panel-api.py
    cp -r frontend $out/share/panel/frontend

    mkdir -p xterm fit $out/share/panel/frontend/vendor
    tar -xzf ${xterm} -C xterm
    tar -xzf ${xtermFit} -C fit
    install -m644 xterm/package/lib/xterm.js xterm/package/css/xterm.css fit/package/lib/addon-fit.js \
      $out/share/panel/frontend/vendor/

    install -Dm755 panelctl.sh $out/bin/panelctl
    patchShebangs --host $out/bin/panelctl
    wrapProgram $out/bin/panelctl \
      --suffix PATH : ${lib.makeBinPath runtimeDeps}

    makeWrapper ${python.interpreter} $out/bin/panel-api \
      --add-flags $out/share/panel/panel-api.py \
      --suffix PATH : ${lib.makeBinPath runtimeDeps} \
      --set-default PANELCTL_PATH $out/bin/panelctl \
      --set-default PANEL_FRONTEND_DIR $out/share/panel/frontend

    runHook postInstall
  '';

  meta = {
    description = "Small web panel for deploying Podman compose apps behind Caddy";
    mainProgram = "panel-api";
    platforms = lib.platforms.linux;
  };
}