{ lib, stdenv, fetchurl, makeWrapper, apr, expat, gnused, sslSupport ? true
, openssl, bdbSupport ? true, db, ldapSupport ? !stdenv.isCygwin, openldap
, libiconv, libxcrypt, cyrus_sasl, autoreconfHook }:

assert sslSupport -> openssl != null;
assert bdbSupport -> db != null;
assert ldapSupport -> openldap != null;

stdenv.mkDerivation rec {
  pname = "apr-util";
  version = "1.6.3";

  src = fetchurl {
    url = "mirror://apache/apr/${pname}-${version}.tar.bz2";
    sha256 = "sha256-pBB243EHRjJsOUUEKZStmk/KwM4Cd92P6gdv7DyXcrU=";
  };

  patches = [
    ./fix-libxcrypt-build.patch
    # Fix incorrect Berkeley DB detection with newer versions of clang due to implicit `int` on main errors.
    ./clang-bdb.patch
  ] ++ lib.optional stdenv.isFreeBSD ./include-static-dependencies.patch;

  NIX_CFLAGS_LINK = [ "-lcrypt" ];

  outputs = [ "out" "dev" ];
  outputBin = "dev";

  nativeBuildInputs = [ makeWrapper autoreconfHook ];

  configureFlags = [ "--with-apr=${apr.dev}" "--with-expat=${expat.dev}" ]
    ++ lib.optional (!stdenv.isCygwin) "--with-crypto"
    ++ lib.optional sslSupport "--with-openssl=${openssl.dev}"
    ++ lib.optional bdbSupport "--with-berkeley-db=${db.dev}"
    ++ lib.optional ldapSupport "--with-ldap=ldap"
    ++ lib.optionals stdenv.isCygwin [
      "--without-pgsql"
      "--without-sqlite2"
      "--without-sqlite3"
      "--without-freetds"
      "--without-berkeley-db"
      "--without-crypto"
    ];

  postConfigure = ''
    echo '#define APR_HAVE_CRYPT_H 1' >> confdefs.h
  '' +
    # For some reason, db version 6.9 is selected when cross-compiling.
    # It's unclear as to why, it requires someone with more autotools / configure knowledge to go deeper into that.
    # Always replacing the link flag with a generic link flag seems to help though, so let's do that for now.
    lib.optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
      substituteInPlace Makefile \
        --replace "-ldb-6.9" "-ldb"
      substituteInPlace apu-1-config \
        --replace "-ldb-6.9" "-ldb"
    '';

  propagatedBuildInputs = [ apr expat libiconv libxcrypt ]
    ++ lib.optional sslSupport openssl ++ lib.optional bdbSupport db
    ++ lib.optional ldapSupport openldap
    ++ lib.optional stdenv.isFreeBSD cyrus_sasl;

  postInstall = ''
    for f in $out/lib/*.la $out/lib/apr-util-1/*.la $dev/bin/apu-1-config; do
      substituteInPlace $f \
        --replace "${expat.dev}/lib" "${expat.out}/lib" \
        --replace "${db.dev}/lib" "${db.out}/lib" \
        --replace "${openssl.dev}/lib" "${lib.getLib openssl}/lib"
    done

    # Give apr1 access to sed for runtime invocations.
    wrapProgram $dev/bin/apu-1-config --prefix PATH : "${gnused}/bin"
  '';

  enableParallelBuilding = true;

  passthru = { inherit sslSupport bdbSupport ldapSupport; };

  meta = with lib; {
    homepage = "https://apr.apache.org/";
    description = "A companion library to APR, the Apache Portable Runtime";
    mainProgram = "apu-1-config";
    maintainers = [ maintainers.eelco ];
    platforms = platforms.unix;
    license = licenses.asl20;
  };
}