{ lib
, stdenv
, fetchurl
, dpkg
, autoPatchelfHook
, runCommand
, dbus
, libpcap
, nss
, zlib
, openssl
, libcap
, glib
, gtk3
}:

let
  pname = "cloudflare-warp";
  version = "2025.10.186.0";

  # Upstream wants libpcap.so.0.8, but nixpkgs provides a newer SONAME.
  libpcapCompat = runCommand "libpcap-compat-0.8" { } ''
    mkdir -p "$out/lib"
    if [ -e "${libpcap}/lib/libpcap.so.1" ]; then
      ln -s "${libpcap}/lib/libpcap.so.1" "$out/lib/libpcap.so.0.8"
    elif [ -e "${libpcap}/lib/libpcap.so" ]; then
      ln -s "${libpcap}/lib/libpcap.so" "$out/lib/libpcap.so.0.8"
    else
      echo "cloudflare-warp: could not find libpcap in ${libpcap}/lib" >&2
      exit 1
    fi
  '';

  src =
    if stdenv.hostPlatform.system == "x86_64-linux" then
      fetchurl {
        url = "https://pkg.cloudflareclient.com/pool/focal/main/c/cloudflare-warp/cloudflare-warp_${version}_amd64.deb";
        hash = "sha256-WZK2ihpfr+FG0TWtDAxfauzGDe25pWydF9tJ+6BJ0YA=";
      }
    else if stdenv.hostPlatform.system == "aarch64-linux" then
      fetchurl {
        url = "https://pkg.cloudflareclient.com/pool/focal/main/c/cloudflare-warp/cloudflare-warp_${version}_arm64.deb";
        hash = "sha256-WBs6uREZla1dnwg+XyNtTZA7NQyrbnb+RuQXe+mW8yw=";
      }
    else
      throw "${pname}: unsupported system: ${stdenv.hostPlatform.system}";
in
stdenv.mkDerivation {
  inherit pname version src;

  nativeBuildInputs = [
    dpkg
    autoPatchelfHook
  ];

  buildInputs = [
    dbus
    libpcapCompat
    nss
    zlib
    openssl
    libcap
    glib
    gtk3
    stdenv.cc.cc.lib
  ];

  unpackPhase = ''
    runHook preUnpack
    dpkg-deb -x "$src" .
    runHook postUnpack
  '';

  dontBuild = true;

  installPhase = ''
    runHook preInstall

    mkdir -p "$out"

    for d in bin etc lib usr; do
      if [ -e "$d" ]; then
        cp -R "$d" "$out/"
      fi
    done

    # Flatten /usr into the output (Nix-style layout).
    if [ -d "$out/usr" ]; then
      cp -R "$out/usr/"* "$out/"
      rm -rf "$out/usr"
    fi

    # Fix .desktop files to use absolute Nix store paths.
    for f in "$out/share/applications/"*.desktop "$out/etc/xdg/autostart/"*.desktop; do
      [ -e "$f" ] || continue
      substituteInPlace "$f" \
        --replace-warn "Exec=systemctl --user start warp-taskbar" "Exec=$out/bin/warp-taskbar"
    done

    # Fix systemd service files to use absolute Nix store paths.
    if [ -e "$out/lib/systemd/system/warp-svc.service" ]; then
      substituteInPlace "$out/lib/systemd/system/warp-svc.service" \
        --replace-warn "/bin/warp-svc" "$out/bin/warp-svc"
    fi

    if [ -e "$out/lib/systemd/user/warp-taskbar.service" ]; then
      substituteInPlace "$out/lib/systemd/user/warp-taskbar.service" \
        --replace-warn "/bin/warp-taskbar" "$out/bin/warp-taskbar"
    fi

    runHook postInstall
  '';

  meta = {
    description = "Cloudflare WARP client for Zero Trust / WARP VPN (binary release)";
    homepage = "https://1.1.1.1/";
    license = lib.licenses.unfreeRedistributable;
    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
    platforms = [ "x86_64-linux" "aarch64-linux" ];
    mainProgram = "warp-cli";
  };
}