{
  lib,
  rustPlatform,
  fetchFromGitHub,
  fetchurl,
  pkg-config,
  openssl,
}:

rustPlatform.buildRustPackage rec {
  pname = "nftablesbuilder";
  # Pinned to a commit rather than a release tag because upstream
  # publishes releases only as tarballs on nftablesbuilder.eu.
  version = "0.1.0-unstable-2026-01-27";

  src = fetchFromGitHub {
    owner = "AiseBouma";
    repo = "NftablesBuilder";
    rev = "f414e921c2857556cdb4d602ed832a32a6951d25";
    hash = "sha256-5qwyVXLrUxOk7poVdUyi/yJUq1CYMffruvAO0ONO+cI=";
  };

  # Upstream source is incomplete: both crates depend on a `settings`
  # crate (path = "../settings") that was never committed, and the GUI
  # has no build tooling (raw TSX, no package.json). This patch adds
  # the missing settings crate (schema recovered from the official
  # release artifacts) plus a workspace Cargo.toml.
  patches = [ ./settings-workspace.patch ];

  cargoLock.lockFile = ./Cargo.lock;

  # Prebuilt GUI from the official release tarball, since the GUI cannot
  # be built from source. Upstream serves releases with a self-signed
  # TLS certificate, hence curlOpts = "-k"; the hash still pins content.
  guiSrc = fetchurl {
    url = "https://nftablesbuilder.eu/releases/latest/nftablesbuilder.tar.gz";
    sha256 = "sha256-vHyuKVH4OtXEisWeDo+b3gHg3TzdXUSfMbaNpfQOrns=";
    curlOpts = "-k";
  };

  nativeBuildInputs = [ pkg-config ];
  buildInputs = [ openssl ];

  installPhase = ''
    runHook preInstall

    binDir=$(dirname "$(find target -type f -name nftablesbuilder -path '*/release/*' | head -1)")
    install -Dm755 $binDir/nftablesbuilder $out/bin/nftablesbuilder
    install -Dm755 $binDir/webserver $out/libexec/nftablesbuilder/webserver

    mkdir -p $out/share/nftablesbuilder
    tar -xzf $guiSrc -C $out/share/nftablesbuilder --strip-components=4 nftablesbuilder/root/opt/nftablesbuilder/html
    install -Dm644 ${./settings.example} $out/share/nftablesbuilder/settings.example

    runHook postInstall
  '';

  passthru = {
    category = "Networking";
  };

  meta = with lib; {
    description = "Web interface to manage nftables rules";
    homepage = "https://github.com/AiseBouma/NftablesBuilder";
    license = licenses.mit;
    mainProgram = "nftablesbuilder";
    platforms = platforms.linux;
  };
}