{
  autoPatchelfHook,
  buildFHSEnvChroot ? false,
  buildFHSUserEnv ? false,
  dpkg,
  fetchurl,
  lib,
  stdenv,
  sysctl,
  iptables,
  iproute2,
  procps,
  cacert,
  libxml2,
  libidn2,
  libnl,
  libcap, 
  libcap_ng,
  zlib,
  makeWrapper,
  wireguard-tools,
}:

let
  buildEnv = if builtins.typeOf buildFHSEnvChroot == "set" then buildFHSEnvChroot else buildFHSUserEnv;
  pname = "nordvpn";
  version = "4.0.0";
  janis-bhm = {
    name = "Janis B.";
    email = "janis@nirgendwo.xyz";
    github = "janis-bhm";
  };

  libxml2_13 = libxml2.overrideAttrs rec {
    version = "2.13.8";
    src = fetchurl {
      url = "mirror://gnome/sources/libxml2/${lib.versions.majorMinor version}/libxml2-${version}.tar.xz";
      hash = "sha256-J3KUyzMRmrcbK8gfL0Rem8lDW4k60VuyzSsOhZoO6Eo=";
    };
  };

  nordvpnd = buildEnv {
    name = "nordvpnd";
    runScript = "nordvpnd";

    extraBuildCommands = ''
mkdir -p $out/usr/lib
ln -s ${nordvpn}/lib/nordvpn $out/usr/lib/nordvpn
'';

    targetPkgs = pkgs: with pkgs; [
      nordvpn
      iproute2
      iptables
      procps
      sysctl
      makeWrapper
      wireguard-tools
      zlib
      cacert
    ];
  };

  nordvpn = stdenv.mkDerivation {
    inherit pname version;

    src = fetchurl {
      url = "https://repo.nordvpn.com/deb/nordvpn/debian/pool/main/n/nordvpn/nordvpn_${version}_amd64.deb";
      hash = "sha256-elKREKiFrx2TgJPJl1ARtEebsv4PNG9fMq2mrV9xngs=";
    };

    buildInputs = [
      libxml2_13 
      libidn2
      libnl
      libcap
      libcap_ng
    ];

    nativeBuildInputs = [
      dpkg
      autoPatchelfHook
      stdenv.cc.cc.lib
      libxml2
    ];

    dontConfigure = true;
    dontBuild = true;

    unpackPhase = ''
      runHook preUnpack
      dpkg --extract $src .
      runHook postUnpack
    '';

    installPhase = ''
      runHook preInstall
      mkdir -p $out
      mv usr/sbin/nordvpnd usr/bin/nordvpnd
      mv usr/* $out/
      mv var/ $out/
      runHook postInstall
    '';

    # wrap nordvpnd with iproute2, procps, sysctl, iptables path prefixes
    # postInstall = ''
    #   wrapProgram $out/bin/nordvpnd \
    #     --prefix PATH : "${lib.makeBinPath [ iproute2 ]}" \
    #     --prefix PATH : "${lib.makeBinPath [ procps ]}" \
    #     --prefix PATH : "${lib.makeBinPath [ sysctl ]}" \
    #     --prefix PATH : "${lib.makeBinPath [ iptables ]}" '';

  };
in stdenv.mkDerivation {
  inherit pname version;

  dontConfigure = true;
  dontBuild = true;
  dontUnpack = true;

  installPhase = ''
    runHook preInstall
    mkdir -p $out/bin $out/share
    ln -s ${nordvpn}/bin/nordvpn $out/bin
    ln -s ${nordvpnd}/bin/nordvpnd $out/bin
    ln -s ${nordvpn}/share* $out/share
    ln -s ${nordvpn}/var $out
    runHook postInstall
  '';

  meta = with lib; {
    description = "CLI client for NordVPN";
    homepage = "https://www.nordvpn.com";
    license = licenses.unfree;
    maintainers = with maintainers; [ janis-bhm ];
    platforms = [ "x86_64-linux" ];
  };
}