{
  description = "A modern web frontend for aria2";

  inputs = {
    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
    flake-utils.url = "github:numtide/flake-utils";
  };

  outputs = { self, flake-utils, nixpkgs }: {
    overlay = final: prev: {
      AriaNg =
        let
          # mark nodejs 10 as secure, YOLO
          # it is somewhat acceptable, because it only gets used for the build
          # upstream recommends using node 8, so using node 10 is the more secure option
          # https://github.com/mayswind/AriaNg/issues/606#issuecomment-842461874
          nodejs = prev.nodejs-10_x.overrideAttrs (o: o // { meta = o.meta // { knownVulnerabilities = [ ]; }; });

          nodeDependencies = (prev.callPackage ./build-dependencies.nix { pkgs = prev; inherit nodejs; }).shell.nodeDependencies;
        in
        prev.stdenvNoCC.mkDerivation {
          pname = "AriaNg";
          version = "1.1.7";

          src = self;

          buildPhase = ''
            ln -s ${nodeDependencies}/lib/node_modules ./node_modules

            # shebang uses nodejs-12_x?
            ${nodejs}/bin/node ${nodeDependencies}/bin/gulp clean build
          '';

          installPhase = ''
            cp -r dist $out
          '';
        };
    };
  } // flake-utils.lib.eachDefaultSystem (system:
    let
      pkgs = import nixpkgs { inherit system; overlays = [ self.overlay ]; };
    in
    rec {
      packages = {
        inherit (pkgs) AriaNg;
      };

      defaultPackage = packages.AriaNg;

      apps = {
        update = {
          type = "app";
          program = toString (pkgs.writeShellScript "update" ''
            ${pkgs.nodePackages.node2nix}/bin/node2nix \
                --nodejs-10 \
                --development \
                --composition build-dependencies.nix \
                --lock package-lock.json
          '');
        };
      };
    });
}