{
  description = "Healthchecks";

  inputs = {
    nixpkgs = {
      url = "nixpkgs/nixos-unstable";
    };
  };

  outputs = { self, nixpkgs }@inputs:
    let
      system = "x86_64-linux";
      pkgs = import nixpkgs {
        inherit system;
      };
      py = pkgs.python3.override {
        packageOverrides = final: prev: {
          django = prev.django_4;
        };
      };
      baseImage = {
        tag = "latest";
        maxLayers = 2;
        contents = [
          pkgs.bash
          pkgs.coreutils-full
        ];
        config = {
          User = "5000:5000";
          Volumes = {
            "/tmp" = { };
          };
          WorkingDir = "${self.packages.${system}.healthchecks}/app";
          Env = [
            "LANG=en_US.UTF-8"
            "PYTHONPATH=${self.packages.${system}.healthchecks.pythonPath}"
            "PYTHONUNBUFFERED=1"
            "SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
            "STATIC_ROOT=${self.packages.${system}.healthchecks}/static"
          ];
        };
      };
    in
    {
      packages.${system} = {
        healthchecks =
          let
            pname = "healthchecks";
            version = "2.8.1";
            hash = "sha256-lJ0AZJpznet2YKPIyMOx5ZdETZB8de5vp7sydfndxZg=";
            localSettings = pkgs.writeText "local_settings.py" ''
              import os
              STATIC_ROOT = os.getenv("STATIC_ROOT")
              SECRET_KEY_FILE = os.getenv("SECRET_KEY_FILE")
              if SECRET_KEY_FILE:
                  with open(SECRET_KEY_FILE, "r") as file:
                      SECRET_KEY = file.readline()
            '';
            propagatedBuildInputs = with py.pkgs; [
              apprise
              cron-descriptor
              cronsim
              django
              django-compressor
              fido2
              minio
              psycopg2
              pycurl
              pyotp
              segno
              statsd
              whitenoise
            ];
          in
          py.pkgs.buildPythonApplication {
            inherit pname version propagatedBuildInputs;
            format = "other";

            src = pkgs.fetchFromGitHub {
              owner = "healthchecks";
              repo = pname;
              rev = "v${version}";
              inherit hash;
            };

            installPhase = ''
              mkdir -p $out/app
              cp -r . $out/app
              chmod +x $out/app/manage.py
              cp ${localSettings} $out/app/hc/local_settings.py
              DEBUG=False SECRET_KEY=build-key STATIC_ROOT=$out/static ${py}/bin/python $out/app/manage.py collectstatic --noinput
              DEBUG=False SECRET_KEY=build-key STATIC_ROOT=$out/static ${py}/bin/python $out/app/manage.py compress
            '';

            passthru = {
              # PYTHONPATH of all dependencies used by the package
              pythonPath = py.pkgs.makePythonPath propagatedBuildInputs;

              tests = {
                inherit (pkgs.nixosTests) healthchecks;
              };
            };

            meta = with pkgs.lib; {
              homepage = "https://github.com/healthchecks/healthchecks";
              description = "A cron monitoring tool written in Python & Django ";
              license = licenses.bsd3;
            };
          };

        smtpd = pkgs.dockerTools.buildLayeredImage (
          pkgs.lib.attrsets.recursiveUpdate baseImage {
            name = "healthchecks-smtpd";
            config = {
              Cmd = [
                "${self.packages.${system}.healthchecks}/app/manage.py"
                "smtpd"
                "--port"
                "2525"
              ];
              ExposedPorts = {
                "2525/tcp" = { };
              };
            };
          }
        );

        sendalerts = pkgs.dockerTools.buildLayeredImage (
          pkgs.lib.attrsets.recursiveUpdate baseImage {
            name = "healthchecks-sendalerts";
            config = {
              Cmd = [
                "${self.packages.${system}.healthchecks}/app/manage.py"
                "sendalerts"
              ];
              ExposedPorts = { };
            };
          }
        );

        maintenance =
          let
            script = pkgs.writeScript "maintenance" ''
              CURL_OPTIONS="--fail --silent --show-error --max-time 10 --retry 5 --output /dev/null"
              ${pkgs.curl}/bin/curl $CURL_OPTIONS http://webserver.healthchecks.svc/ping/$MAINTENANCE_CHECK_UUID/start
              ${self.packages.${system}.healthchecks}/app/manage.py prunenotifications
              ${self.packages.${system}.healthchecks}/app/manage.py pruneusers
              ${self.packages.${system}.healthchecks}/app/manage.py prunetokenbucket
              ${self.packages.${system}.healthchecks}/app/manage.py pruneflips
              ${pkgs.curl}/bin/curl $CURL_OPTIONS http://webserver.healthchecks.svc/ping/$MAINTENANCE_CHECK_UUID
            '';
          in
          pkgs.dockerTools.buildLayeredImage
            (
              pkgs.lib.attrsets.recursiveUpdate baseImage {
                name = "healthchecks-maintenance";
                config = {
                  Cmd = [
                    "${script}"
                  ];
                  ExposedPorts = { };
                };
              }
            );

        migrate = pkgs.dockerTools.buildLayeredImage (
          pkgs.lib.attrsets.recursiveUpdate baseImage {
            name = "healthchecks-migrate";
            config = {
              Cmd = [
                "${self.packages.${system}.healthchecks}/app/manage.py"
                "migrate"
              ];
              ExposedPorts = { };
            };
          }
        );

        webserver =
          let
            uwsgi = pkgs.uwsgi.override {
              plugins = [ "python3" ];
            };
            uwsgi-ini = pkgs.writeTextFile {
              name = "uwsgi.ini";
              text = ''
                [uwsgi]
                buffer-size = 32768
                chdir = ${self.packages.${system}.healthchecks}/app
                die-on-term
                disable-write-exception
                enable-threads
                harakiri = 10
                http-socket = :8000
                master
                mime-file = ${pkgs.mailcap}/etc/nginx/mime.types
                module = hc.wsgi:application
                plugins = python3
                post-buffering = 4096
                processes = 4
                static-map = /static=${self.packages.${system}.healthchecks}/static
                threads = 1
                thunder-lock
              '';
            };
          in
          pkgs.dockerTools.buildLayeredImage (
            pkgs.lib.attrsets.recursiveUpdate baseImage {
              name = "healthchecks-webserver";
              fakeRootCommands = '';
                mkdir /tmp
                chmod 0777 /tmp
              '';
              config = {
                Cmd = [
                  "${uwsgi}/bin/uwsgi"
                  "${uwsgi-ini}"
                ];
                ExposedPorts = {
                  "8000/tcp" = { };
                };
              };
            }
          );
      };
    };
}