{
  lib,
  stdenvNoCC,
  makeWrapper,
  bash,
  python3,
  podman,
  podman-compose,
  curl,
  coreutils,
  gnugrep,
  gnused,
  gawk,
  findutils,
  zip,
  unzip,
  git,
  util-linux,
  openssh,
}:

let
  # Tools panelctl shells out to. They are appended to PATH, so the host's own
  # versions (e.g. the system podman) still take precedence when present.
  runtimeDeps = [
    podman
    podman-compose
    curl
    coreutils
    gnugrep
    gnused
    gawk
    findutils
    zip
    unzip
    git
    util-linux # flock, used to serialise routes file writes
    openssh # cloning repositories over ssh with the panel's deploy key
  ];
in
stdenvNoCC.mkDerivation {
  pname = "reudy-panel";
  version = "0.1.0";

  src = lib.fileset.toSource {
    root = ../.;
    fileset = lib.fileset.unions [
      ../panel-api.py
      ../panelctl.sh
      ../frontend
    ];
  };

  nativeBuildInputs = [ makeWrapper ];
  buildInputs = [ bash ];

  dontConfigure = true;
  dontBuild = true;

  installPhase = ''
    runHook preInstall

    install -Dm644 panel-api.py $out/share/panel/panel-api.py
    cp -r frontend $out/share/panel/frontend

    install -Dm755 panelctl.sh $out/bin/panelctl
    patchShebangs --host $out/bin/panelctl
    wrapProgram $out/bin/panelctl \
      --suffix PATH : ${lib.makeBinPath runtimeDeps}

    makeWrapper ${python3.interpreter} $out/bin/panel-api \
      --add-flags $out/share/panel/panel-api.py \
      --suffix PATH : ${lib.makeBinPath runtimeDeps} \
      --set-default PANELCTL_PATH $out/bin/panelctl \
      --set-default PANEL_FRONTEND_DIR $out/share/panel/frontend

    runHook postInstall
  '';

  meta = {
    description = "Small web panel for deploying Podman compose apps behind Caddy";
    mainProgram = "panel-api";
    platforms = lib.platforms.linux;
  };
}