{ stdenv, lib, fetchFromGitHub, 
  autoconf, automake, autoreconfHook, pkgconfig, curl, libevent, glib, libuuid, intltool, sqlite, withMysql ? true, libmysql, libarchive, libtool, jansson, vala, fuse, openssl, libevhtp, ccnet, libsearpc, which,
  # for SeaHub
  python27, python27Packages }:

  let
    version = "7.1.0";
    seafile-server-core = stdenv.mkDerivation rec {
      name = "seafile-server-core";
      inherit version;
      src = fetchFromGitHub {
        owner = "haiwen";
        repo = "seafile-server";
        rev = "v${version}-server";
        sha256 = "sha256:0r3vw145vzhbipwk4cyj1h7sb3szy5hcp36n3pf2jxpwy365ir92";
      };
      # patch to work with latest, non-vulnerable libevhtp
      patches = [
        ./recent_libevhtp.patch
        ];
      # `which` is called directly from python during buildPhase, so we need the binary
      nativeBuildInputs = [ autoconf automake libtool pkgconfig vala autoreconfHook which ];
      buildInputs = [ sqlite glib python27 libuuid openssl fuse libarchive ccnet-server libevent libsearpc libevhtp ];
      checkPhase = "bash ./run_tests.sh";
    };
    seahub = python27Packages.buildPythonApplication rec {
      name = "seahub";
      inherit version;
      src = fetchFromGitHub {
        owner = "haiwen";
        repo = "seahub";
        rev = "v${version}-server";
        sha256 = "sha256:1aypbqrv30x9mmhiwcmkmzmac0mw0gx7cb1n4x90h46iqlbanhnq";
      };
      phases = [ "installPhase" "fixupPhase" "distPhase" ];
      installPhase = ''
        find ./
        '';
    };
    propagatedBuildInputs = with python27Packages; [
      django pytz django-statici18n djangorestframework django_compressor
      django-post_office django-constance gunicorn flup chardet dateutil six
      openpyxl
      ];
    django-constance = python27.buildPythonPackage rec {
      pname = "django-constance";
      version = "1.0.1";
      src = fetchFromGitHub {
        owner = "haiwen";
        repo = pname;
        rev = "bde7f7c";
        sha256 = "sha256:12ccqa3168n0s8mqgywbg87qk72yh9salqxafcq4nc4lc3mcsmxx";
      };
      meta = {
        license = lib.licenses.bsd3;
      };
    };
    ccnet-server = stdenv.mkDerivation rec {
      name = "ccnet-server";
      inherit version;
      src = fetchFromGitHub {
        owner = "haiwen";
        repo = "ccnet-server";
        rev = "v${version}-server";
        sha256 = "sha256:1iazjy013gjz4kg5xxzs9gsyyva9pyjlmslmrkcbkcj1a94g3pwc";
      };

      buildInputs = [ vala libsearpc libuuid sqlite openssl libevent glib python27 ]
      ++ lib.optional (!withMysql) "--without-mysql";
      # `which` is called directly from python during buildPhase, so we need the binary
      nativeBuildInputs = [ autoconf automake libtool pkgconfig autoreconfHook which ];
      configureFlags = [ "--disable-static" ];

      meta = {
        description = "Internal communication framework and user/group management for Seafile server";
        license = lib.licenses.agpl3; # with additional OpenSSL linking exception
      };
    };

  in stdenv.mkDerivation {
    name = "seafile-server";
    inherit version;

    buildInputs = [ seahub seafile-server-core ccnet-server libsearpc ]
      ++ lib.optional withMysql libmysql;
      phases = [ "installPhase" "fixupPhase" "distPhase" ];
    # todo: create data directory in /srv in activation script
    inherit seafile-server-core;
  }