{
  lib,
  rustPlatform,
  fetchFromGitHub,
  cmake,
  perl,
}:

rustPlatform.buildRustPackage rec {
  pname = "awg-tool";
  version = "0.2.2";

  src = fetchFromGitHub {
    owner = "Vadim-Khristenko";
    repo = "awg-containers-and-tools";
    rev = "v${version}";
    hash = "sha256-z4LG+z60uqsfkRyt7Dc8Fc5GMfpiF7G0N9PXnzTUJms=";
  };

  # awg-core builds ssh2 with vendored-openssl, which compiles libssh2
  # (via cmake) and OpenSSL (via perl Configure) from source.
  nativeBuildInputs = [
    cmake
    perl
  ];

  cargoHash = "sha256-Nb5tmwvhzKAldHai7yxtYapjbZmai0ujBX9c6nRGZk0=";

  # Upstream tests exercise Docker/SSH targets; unit tests are already
  # covered by the upstream CI before a release is cut.
  doCheck = false;

  passthru = {
    category = "Networking";
    updateScript = [
      "nix-update"
      "--flake"
      ".#awg-tool"
    ];
  };

  meta = with lib; {
    description = "CLI for AmneziaWG self-hosting — generates 1.0/1.5/2.0/3.0 obfuscation parameters, exports .conf and vpn:// configs, installs servers over SSH";
    homepage = "https://github.com/Vadim-Khristenko/awg-containers-and-tools";
    changelog = "https://github.com/Vadim-Khristenko/awg-containers-and-tools/releases/tag/v${version}";
    license = licenses.mit;
    sourceProvenance = with sourceTypes; [ fromSource ];
    mainProgram = "awg-tool";
    platforms = platforms.linux;
  };
}