{
  lib,
  python3Packages,
}:
python3Packages.buildPythonApplication {
  pname = "legacy-email-proxy";
  inherit ((lib.importTOML ./pyproject.toml).project) version;
  pyproject = true;

  # Only the files that affect the build, so editing the README or the CI
  # workflow does not invalidate it.
  src = lib.fileset.toSource {
    root = ./.;
    fileset = lib.fileset.unions [
      ./proxy_server.py
      ./pyproject.toml
      ./requirements.txt
      ./pytest.ini
      ./tests
    ];
  };

  build-system = [ python3Packages.setuptools ];
  dependencies = [ python3Packages.aiosmtpd ];

  nativeCheckInputs = [ python3Packages.pytestCheckHook ];

  meta = {
    description = "Unauthenticated POP3/SMTP front end proxied to authenticated IMAPS/SMTPS backends";
    longDescription = ''
      Exposes cleartext POP3 and SMTP to clients that cannot speak TLS or
      modern authentication, and forwards them to an authenticated IMAPS/SMTPS
      backend. The front-end listeners are unauthenticated by design and must
      be confined to a trusted network.
    '';
    homepage = "https://code.emmathe.dev/lyrathorpe/legacy-email-proxy";
    mainProgram = "legacy-email-proxy";
    platforms = lib.platforms.unix;
  };
}