{
  lib,
  dockerTools,
  php,
  bash,
  nginx,
  blackfire,
  coreutils,
  getent,
  writers,
  shadow,
  runCommand,
  callPackage,
  cronie,
  redis,
  gnused,
  samba,
  wget,
  curl,
  git,
  sqlite-interactive,
  procps,
  gnugrep,
  minio-client,
  sudo,
  su,
  which,
  clamav,
  jq,
  oracle-instantclient,
  debug ? false,
  writeShellApplication,
  vim,
  helix,
  python3Packages,
  dnsmasq,
  frankenphp,
  nushell,
  nix2container,
  buildEnv,
}: let
  inherit (builtins) toString compareVersions;
  inherit
    (lib)
    readFile
    getExe
    concatStringsSep
    splitString
    take
    optionals
    ;

  version = (fromTOML (readFile ../../Cargo.toml)).package.version;

  phpVersion = concatStringsSep "." (take 2 (splitString "." php.version));
  phpEnv = callPackage ./php.nix {inherit debug php;};

  bootstrap = writers.writeNuBin "bootstrap" (readFile ./bootstrap);
  shadowSetupScript = writeShellApplication {
    name = "shadow-setup";
    text = dockerTools.shadowSetup;
  };

  baseDirs = runCommand "tmp-dir" {} ''
    mkdir -p $out/tmp
    mkdir -p $out/var/cache/nginx
    mkdir -p $out/var/log/nginx
    mkdir -p $out/var/log/cron
    mkdir -p $out/var/www/html
    mkdir -p $out/var/run
    mkdir -p $out/var/tmp
    mkdir -p $out/run
    mkdir -p $out/conf
    mkdir -p $out/var/spool
  '';
  configs = callPackage ./configs.nix {};
  scripts = callPackage ./scripts.nix {};
  phpunitUnwrapped = majorVersion:
    callPackage ./phpunit.nix {
      inherit majorVersion;
      php = phpEnv;
    };

  phpunit = writeShellApplication {
    name = "phpunit";
    runtimeInputs = [jq];
    text = ''
      MAJOR=$(jq -r 'first(.require."phpunit/phpunit" | scan("[[:digit:]]+"))' vendor-bin/phpunit/composer.json)
      case "$MAJOR" in
        9)
        PKG=${phpunitUnwrapped "9"}
        ;;
        10)
        PKG=${phpunitUnwrapped "10"}
        ;;
        11)
        PKG=${phpunitUnwrapped "11"}
        ;;
        12)
        PKG=${phpunitUnwrapped "12"}
        ;;
        13)
        PKG=${phpunitUnwrapped "13"}
        ;;
        *)
        PKG=${phpunitUnwrapped "10"}
        ;;
      esac
      "$PKG"/bin/phpunit "$@"
    '';
  };

  certificates = runCommand "scripts" {} ''
    mkdir -p $out
    cp -r ${../../certificates} $out/certificates
  '';
  clamav-data = runCommand "scripts" {} ''
    mkdir -p $out/etc
    mkdir -p $out/var/lib/clamav
    cp ${data/clamav/daily.cvd} $out/var/lib/clamav/daily.cvd
    cp -r ${configs/clamav} $out/etc/clamav
  '';

  basePackages = [
    dockerTools.caCertificates
    dockerTools.usrBinEnv
    bash
    blackfire
    nginx
    coreutils
    shadow
    cronie
    redis
    gnused
    procps
    gnugrep
    minio-client
    sudo
    su
    which
    git
    sqlite-interactive
    clamav
    samba
    wget
    curl
    oracle-instantclient
    vim
    helix
    python3Packages.supervisor
    dnsmasq
    nushell
    getent
    clamav-data
  ];

  phpPackages =
    [
      phpEnv
      phpEnv.packages.composer
      phpunit
    ]
    ++ optionals ((compareVersions phpVersion "8.2") == 1) [
      (frankenphp.override {
        php = php.withExtensions (
          import ./php-ext.nix {
            inherit lib php;
            enableBlackfire = false;
          }
        );
      })
    ];

  # https://blog.eigenvalue.net/2023-nix2container-everything-once/
  foldImageLayers = let
    mergeToLayer = priorLayers: component:
      assert builtins.isList priorLayers;
      assert builtins.isAttrs component; let
        layer = nix2container.buildLayer (
          component
          // {
            layers = priorLayers;
          }
        );
      in
        priorLayers ++ [layer];
  in
    layers: lib.foldl mergeToLayer [] layers;
in
  nix2container.buildImage {
    name = "icewind1991/haze";
    tag = phpVersion;
    layers = foldImageLayers [
      {
        copyToRoot = buildEnv {
          name = "base";
          paths = basePackages;
          pathsToLink = [
            "/bin"
            "/sbin"
            "/etc"
            "/usr"
            "/conf"
          ];
        };
      }
      {
        copyToRoot = buildEnv {
          name = "php";
          paths = phpPackages;
          pathsToLink = ["/bin"];
        };
      }
      {
        copyToRoot = [
          baseDirs
          bootstrap
          configs
          scripts
          certificates
          shadowSetupScript
        ];
        perms = [
          {
            path = baseDirs;
            regex = "/tmp|var/(tmp|run|log/nginx|cache/nginx|spool)";
            mode = "0777";
          }
          {
            path = baseDirs;
            regex = "/etc/nc";
            mode = "0755";
          }
        ];
      }
    ];
    config = {
      Cmd = [(getExe bootstrap)];
      Env = [
        "EDITOR=hx"
        "WEBROOT=/var/www/html"
        "HAZE_IMAGE_VERSION=${toString version}"
      ];
      WorkingDir = "/var/www/html";
      Labels = {
        "nl.icewind.haze.version" = toString version;
      };
    };
  }