{
  lib,
  gnused,
  stdenv,
  buildGoModule,
  fetchFromGitHub,
  installShellFiles,
}:
let
  version = "1.11.3";

  externalPlugins = [
    {
      name = "tailscale";
      repo = "github.com/damomurf/coredns-tailscale";
      version = "c1a2b9d941edc6f701223d6e31be4edf46c9746f";
    }
  ];

  attrsToPlugins =
    attrs: builtins.map ({ name, repo, ... }: lib.escapeShellArg "${name}:${repo}") attrs;
  attrsToSources =
    attrs: builtins.map ({ repo, version, ... }: lib.escapeShellArg "${repo}@${version}") attrs;
in
buildGoModule {
  pname = "coredns";
  inherit version;

  src = fetchFromGitHub {
    owner = "coredns";
    repo = "coredns";
    rev = "v${version}";
    # sha256 = lib.fakeSha256;
    sha256 = "8LZMS1rAqEZ8k1IWSRkQ2O650oqHLP0P31T8oUeE4fw=";
  };

  # vendorHash = lib.fakeHash;
  vendorHash = "sha256-9oq+oNxOmHuFDIn1hQu7BBb76s615B6Mm3JxqSpEOuI=";

  nativeBuildInputs = [ installShellFiles ];

  outputs = [
    "out"
    "man"
  ];

  # Override the go-modules fetcher derivation to fetch plugins
  modBuildPhase = ''
    for plugin in ${builtins.toString (attrsToPlugins externalPlugins)}; do
      echo "Adding plugin $plugin"
      ${gnused}/bin/sed -i "/forward:forward/i$plugin" plugin.cfg
    done

    for src in ${builtins.toString (attrsToSources externalPlugins)}; do
      echo "Retrieving $src"
      go get $src
    done

    go generate
    go mod tidy
    go mod vendor
  '';

  modInstallPhase = ''
    mv -t vendor go.mod go.sum plugin.cfg
    cp -r --reflink=auto vendor "$out"
  '';

  preBuild = ''
    chmod -R u+w vendor
    mv -t . vendor/go.{mod,sum} vendor/plugin.cfg

    go generate
  '';

  postPatch =
    ''
      substituteInPlace test/file_cname_proxy_test.go \
        --replace "TestZoneExternalCNAMELookupWithProxy" \
                  "SkipZoneExternalCNAMELookupWithProxy"

      substituteInPlace test/readme_test.go \
        --replace "TestReadme" "SkipReadme"

      # this test fails if any external plugins were imported.
      # it's a lint rather than a test of functionality, so it's safe to disable.
      substituteInPlace test/presubmit_test.go \
        --replace "TestImportOrdering" "SkipImportOrdering"
    ''
    + lib.optionalString stdenv.isDarwin ''
      # loopback interface is lo0 on macos
      sed -E -i 's/\blo\b/lo0/' plugin/bind/setup_test.go
    '';

  postInstall = ''
    installManPage man/*
  '';
}