{
  description = "Guardant Control Center (grdcontrol) package + NixOS service (single-file flake)";

  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";

  outputs = { self, nixpkgs }:
    let
      lib = nixpkgs.lib;
      systems = [ "x86_64-linux" ];
      forAllSystems = f: lib.genAttrs systems (system: f system);

      overlay = final: prev: {
        grdcontrol = final.callPackage
          ({ stdenv
           , lib
           , fetchzip
           , dpkg
           , autoPatchelfHook
           , xorg
           }:
           let
             pname = "grdcontrol";
             version = "4.4.3";
           in
           stdenv.mkDerivation {
             inherit pname version;

             src = fetchzip {
               url = "https://download.guardant.ru/Guardant_Control_Center/${version}/grdcontrol-${version}_amd64.deb";
               hash = "sha256-1JvZaEPo6IEkcOVsx7PLW1fCUbbn/Bn89iz/4IAmZAs=";
               nativeBuildInputs = [ dpkg ];
             };

             nativeBuildInputs = [ autoPatchelfHook ];

             propagatedBuildInputs = [
               xorg.libxcb
             ];

             installPhase = ''
               runHook preInstall

               mkdir -p $out/{opt,lib}/
               # don't copy etc cause it contain only legacy init.d script
               cp -R opt $out/

               mkdir -p $out/lib/systemd/system/
               cp $out/opt/guardant/grdcontrol/grdcontrol.service \
                  $out/lib/systemd/system/grdcontrol.service

               substituteInPlace $out/lib/systemd/system/grdcontrol.service \
                 --replace-fail "/opt/guardant" "$out/opt/guardant"

               runHook postInstall
             '';

             dontBuild = true;

             meta = with lib; {
               description = "Professional solutions for software monetization and protection";
               homepage = "https://www.guardant.com/support/users/control-center/";
               platforms = [ "x86_64-linux" ];
               license = licenses.unfree;
               sourceProvenance = [ sourceTypes.binaryNativeCode ];
             };
           })
          { };
      };
    in
    {
      overlays.default = overlay;

      packages = forAllSystems (system:
        let
          pkgs = import nixpkgs {
            inherit system;
            overlays = [ overlay ];
            config.allowUnfree = true;
          };
        in
        {
          default = pkgs.grdcontrol;
          grdcontrol = pkgs.grdcontrol;
        });

      nixosModules.grdcontrol = { config, lib, pkgs, ... }:
        let
          cfg = config.services.grdcontrol;
        in
        {
          options.services.grdcontrol = {
            enable = lib.mkEnableOption "Guardant Control Center daemon (grdcontrol)";
            package = lib.mkOption {
              type = lib.types.package;
              default = pkgs.grdcontrol;
              defaultText = "pkgs.grdcontrol";
              description = "Package providing grdcontrol and its systemd unit.";
            };
            execStart = lib.mkOption {
              type = lib.types.nullOr lib.types.str;
              default = null;
              description = "Override ExecStart. If null, use unit from the package.";
            };
          };

          config = lib.mkIf cfg.enable {
            # чтобы pkgs.grdcontrol появился в pkgs
            nixpkgs.overlays = [ overlay ];

            nixpkgs.config.allowUnfree = true;

            # systemd подхватит unit из $pkg/lib/systemd/system
            systemd.packages = [ cfg.package ];

            # включаем сервис в multi-user.target
            systemd.services.grdcontrol = lib.mkMerge [
              {
                wantedBy = [ "multi-user.target" ];
                after = [ "network.target" ];
              }
              (lib.mkIf (cfg.execStart != null) {
                serviceConfig.ExecStart = lib.mkForce cfg.execStart;
              })
            ];
          };
        };
    };
}