{
  lib,
  stdenvNoCC,
  stdenv,
  bun,
  cacert,
  src,  # passed from flake.nix
}:

let
  # Fixed-output derivation to fetch npm dependencies
  # Update the hash when bun.lock changes by running:
  #   nix build .#systant 2>&1 | grep 'got:'
  deps = stdenvNoCC.mkDerivation {
    pname = "systant-deps";
    version = "0.1.0";

    inherit src;

    buildPhase = ''
      export HOME=$TMPDIR
      bun install --frozen-lockfile
    '';

    installPhase = ''
      cp -r node_modules $out
    '';

    nativeBuildInputs = [ bun cacert ];

    outputHashMode = "recursive";
    outputHashAlgo = "sha256";
    # To update: nix build .#systant 2>&1 | grep 'got:'
    outputHash = "sha256-hQ1ZzOFOHHeaAtyfCXxX6jpqB7poFLwavgMW8yMwaHw=";
  };
in
stdenv.mkDerivation {
  pname = "systant";
  version = "0.1.0";

  inherit src;

  nativeBuildInputs = [ bun ];

  buildPhase = ''
    export HOME=$TMPDIR
    cp -r ${deps} node_modules
    chmod -R u+w node_modules
    bun build index.ts --compile --outfile systant
  '';

  installPhase = ''
    mkdir -p $out/bin
    cp systant $out/bin/systant
  '';

  # Bun's compiled binaries don't like being stripped
  dontStrip = true;

  meta = with lib; {
    description = "System monitoring agent with MQTT and Home Assistant integration";
    homepage = "https://git.ryanpandya.com/ryan/systant";
    license = licenses.mit;
    platforms = platforms.linux;
  };
}