{ stdenv, lib, fetchFromGitHub, 
  autoconf, automake, autoreconfHook, pkgconfig, curl, libevent, glib, libuuid, intltool, sqlite, withMysql ? true, libmysql, libarchive, libtool, jansson, vala, fuse, openssl, libevhtp, libsearpc, which,
  # for SeaHub
  python3, python3Packages }:

  let
    version = "7.1.1";
    python = python3;
    pythonPackages = python3Packages;
    django = pythonPackages.django_1_11;
    djangoModules = with pythonPackages; [ django-statici18n django-post_office django-picklefield django-formtools djangorestframework ];
    seahubPythonDependencies = with pythonPackages; [
      django django-webpack-loader future captcha gunicorn pymysql openpyxl qrcode dateutil requests pillow pyjwt pycryptodome
      ]
      ++ map (p: p.override { django = django; }) djangoModules; # build django modules with required version
    seafile-server-core = stdenv.mkDerivation rec {
      name = "seafile-server-core";
      inherit version;
      src = fetchFromGitHub {
        owner = "haiwen";
        repo = "seafile-server";
        rev = "v${version}-server";
        sha256 = "sha256:1y555nm4ic5mbmi87nlp1j23z13na1afziv847xczq3mkach9vqi";
      };
      # patch to work with latest, non-vulnerable libevhtp
      patches = [
        ./recent_libevhtp.patch
        ./django-version.patch
        ];
      # `which` is called directly from python during buildPhase, so we need the binary
      nativeBuildInputs = [ autoconf automake libtool pkgconfig vala autoreconfHook which pythonPackages.wrapPython ];
      buildInputs = [ sqlite glib python libuuid openssl fuse libarchive ccnet-server libevent libevhtp ];
      propagatedBuildInputs = [ libsearpc ] ++ seahubPythonDependencies;
      postFixup = ''
        buildPythonPath $propagatedBuildInputs
        wrapPythonProgramsIn "$out/bin" "$out $pythonPath"
        '';
      checkPhase = "bash ./run_tests.sh";

      meta = with lib; {
        license = licenses.agpl3; # with additional OpenSSL linking exception
        maintainers = with maintainers; [ schmittlauch ];
      };
    };
    seahub = pythonPackages.buildPythonApplication rec {
      name = "seahub";
      inherit version;
      src = fetchFromGitHub {
        owner = "haiwen";
        repo = "seahub";
        rev = "v${version}-server";
        sha256 = "sha256:1s5yd4w5z31hx3x7cd25zgzv7h2yzbdbryypa9in19akmsmb11fp";
      };
      phases = [ "unpackPhase" "installPhase" "fixupPhase" "distPhase" ];
      buildInputs = [ python pythonPackages.wrapPython ];
      propagatedBuildInputs = seahubPythonDependencies ++ [ pythonPackages.seafile-bindings pythonPackages.ccnet-bindings ]; # for `seaserv` module
      installPhase = ''
        cp -r ./ $out
        cd "$out"
        ${python.interpreter} -m compileall ./
        buildPythonPath $propagatedBuildInputs
        set -x
        patchPythonScript manage.py
        '';
      meta = with lib; {
        license = licenses.asl20;
        maintainers = with maintainers; [ schmittlauch ];
      };
    };
    ccnet-server = stdenv.mkDerivation rec {
      name = "ccnet-server";
      inherit version;
      src = fetchFromGitHub {
        owner = "haiwen";
        repo = "ccnet-server";
        rev = "v${version}-server";
        sha256 = "sha256:0hf9mmf019984ybc20zxaqyhcfhhr3k0bjr45pq9d79w16ndnim8";
      };

      buildInputs = [ vala fuse libsearpc libuuid sqlite openssl libarchive libevent glib python ]
      ++ lib.optional (!withMysql) "--without-mysql";
      # `which` is called directly from python during buildPhase, so we need the binary
      nativeBuildInputs = [ autoconf automake libtool pkgconfig autoreconfHook which ];
      configureFlags = [ "--disable-static" ];

      meta = {
        description = "Internal communication framework and user/group management for Seafile server";
        license = lib.licenses.agpl3; # with additional OpenSSL linking exception
      };
    };

  in stdenv.mkDerivation {
    name = "seafile-server";
    inherit version;

    buildInputs = [ seahub seafile-server-core ccnet-server libsearpc ]
      ++ lib.optional withMysql libmysql;
      phases = [ "installPhase" "fixupPhase" "distPhase" ];
    # todo: create data directory in /srv in activation script
    installPhase = ''
      mkdir "$out"
      cd "$out"
      ln -s ${seahub} seahub
      ln -s ${seafile-server-core} seafile-server-latest
      '';
    meta = with lib; {
      maintainers = with maintainers; [ schmittlauch ];
      license = licenses.free; # components with different free software licenses are combined
    };
    inherit ccnet-server seafile-server-core seahub; # for using the path in the NixOS module
}