diff --git a/pkgs/servers/hylafaxplus/config.site b/pkgs/servers/hylafaxplus/config.site
new file mode 100644
index 000000000000..7c8014449216
--- /dev/null
+++ b/pkgs/servers/hylafaxplus/config.site
@@ -0,0 +1,20 @@
+@config_maxgid@
+DIR_BIN="@out_@/bin"
+DIR_FONTMAP="@out_@/share/ghostscript/@ghostscript_version@"
+DIR_LIB="@out_@/lib"
+DIR_LIBDATA="@out_@/spool/etc"
+DIR_LIBEXEC="@out_@/spool/bin"
+DIR_LOCKS=/var/lock
+DIR_MAN="@out_@/share/man"
+DIR_SBIN="@out_@/spool/bin"
+DIR_SPOOL="@out_@/spool"
+FONTMAP="@ghostscript@/share/ghostscript/@ghostscript_version@"
+PATH_AFM="@ghostscript@/share/ghostscript/fonts"
+PATH_DPSRIP="@out_@/spool/bin/ps2fax"
+PATH_EGETTY="@coreutils@/bin/false"
+PATH_GSRIP="@ghostscript@/bin/gs"
+PATH_IMPRIP="@coreutils@/bin/false"
+PATH_SENDMAIL="@coreutils@/bin/false"
+PATH_VGETTY="@coreutils@/bin/false"
+SYSVINIT=no
+TIFFBIN="@libtiff@/bin"
diff --git a/pkgs/servers/hylafaxplus/default.nix b/pkgs/servers/hylafaxplus/default.nix
new file mode 100644
index 000000000000..410d24974268
--- /dev/null
+++ b/pkgs/servers/hylafaxplus/default.nix
@@ -0,0 +1,95 @@
+{ stdenv
+, lib
+, fakeroot
+, fetchurl
+, libfaketime
+, substituteAll
+## runtime dependencies
+, coreutils
+, file
+, findutils
+, gawk
+, ghostscript
+, gnugrep
+, gnused
+, libtiff
+, psmisc
+, sharutils
+, utillinux
+, zlib
+## optional packages (using `null` disables some functionality)
+, jbigkit ? null
+, lcms2 ? null  # for colored faxes
+, openldap ? null
+, pam ? null
+## system-dependent settings that have to be hardcoded
+, maxgid ? 65534  # null -> try to auto-detect (bad on linux)
+, maxuid ? 65534  # null -> hardcoded value 60002
+}:
+
+let
+
+  name = "hylafaxplus-${version}";
+  version = "5.6.0";
+  sha256 = "128514kw9kb5cvznm87z7gis1mpyx4bcqrxx4xa7cbfj1v3v81fr";
+
+  configSite = substituteAll {
+    name = "hylafaxplus-config.site";
+    src = ./config.site;
+    config_maxgid = lib.optionalString (maxgid!=null) ''CONFIG_MAXGID=${builtins.toString maxgid}'';
+    ghostscript_version = ghostscript.version;
+    out_ = "@out@";  # "out" will be resolved in post-install.sh
+    inherit coreutils ghostscript libtiff;
+  };
+
+  postPatch = substituteAll {
+    name = "hylafaxplus-post-patch.sh";
+    src = ./post-patch.sh;
+    inherit configSite;
+    maxuid = lib.optionalString (maxuid!=null) (builtins.toString maxuid);
+    faxcover_binpath = lib.makeBinPath
+      [stdenv.shellPackage coreutils];
+    faxsetup_binpath = lib.makeBinPath
+      [stdenv.shellPackage coreutils findutils gnused gnugrep gawk];
+  };
+
+  postInstall = substituteAll {
+    name = "hylafaxplus-post-install.sh";
+    src = ./post-install.sh;
+    inherit fakeroot libfaketime;
+  };
+
+in
+
+stdenv.mkDerivation {
+  inherit name version;
+  src = fetchurl {
+    url = "mirror://sourceforge/hylafax/hylafax-${version}.tar.gz";
+    inherit sha256;
+  };
+  # Note that `configure` (and maybe `faxsetup`) are looking
+  # for a couple of standard binaries in the `PATH` and
+  # hardcode their absolute paths in the new package.
+  buildInputs = [
+    file  # for `file` command
+    ghostscript
+    libtiff
+    psmisc  # for `fuser` command
+    sharutils  # for `uuencode` command
+    utillinux  # for `agetty` command
+    zlib
+    jbigkit  # optional
+    lcms2  # optional
+    openldap  # optional
+    pam  # optional
+  ];
+  postPatch = ''. ${postPatch}'';
+  dontAddPrefix = true;
+  postInstall = ''. ${postInstall}'';
+  postInstallCheck = ''. ${./post-install-check.sh}'';
+  meta.description = "enterprise-class system for sending and receiving facsimiles";
+  meta.homepage = http://hylafax.sourceforge.net;
+  meta.license = lib.licenses.bsd3;
+  meta.maintainers = [ lib.maintainers.yarny ];
+  meta.platforms = lib.platforms.linux;
+}
diff --git a/pkgs/servers/hylafaxplus/post-install-check.sh b/pkgs/servers/hylafaxplus/post-install-check.sh
new file mode 100644
index 000000000000..2850738edccc
--- /dev/null
+++ b/pkgs/servers/hylafaxplus/post-install-check.sh
@@ -0,0 +1,7 @@
+# check if the package contains all the files needed
+for x in faxq faxquit hfaxd faxcron faxqclean faxgetty
+do
+  test -x "$out/spool/bin/$x"
+done
+test -d "$out/spool/config"
+test -f "$out/spool/etc/setup.cache"
diff --git a/pkgs/servers/hylafaxplus/post-install.sh b/pkgs/servers/hylafaxplus/post-install.sh
new file mode 100644
index 000000000000..ddc7c3f85eda
--- /dev/null
+++ b/pkgs/servers/hylafaxplus/post-install.sh
@@ -0,0 +1,24 @@
+# Parts of the `install` make target don't
+# dare to set file modes (or owners), but put the
+# needed commands in a new file called `root.sh`.
+# We execute the `chmod` commands of
+# this script to set execute bits.
+sed '/chown/d;/chgrp/d' --in-place root.sh
+. root.sh
+
+# We run `faxsetup` to prepare some config files
+# that the admin would have to create otherwise.
+# Since `faxsetup` is quite picky about its environment,
+# we have to prepare some dummy files.
+# `faxsetup` stores today's date in the output files,
+# so we employ faketime to simulate a deterministic date.
+echo "uucp:x:0" >> "$TMPDIR/passwd.dummy"  # dummy uucp user
+touch "$out/spool/etc/config.dummy"  # dummy modem config
+mkdir "$TMPDIR/lock.dummy"  # dummy lock dir
+"@libfaketime@/bin/faketime" -f "$(date --utc --date=@$SOURCE_DATE_EPOCH '+%F %T')" \
+  "@fakeroot@/bin/fakeroot" -- \
+  "$out/spool/bin/faxsetup" -with-DIR_LOCKS="$TMPDIR/lock.dummy" -with-PASSWD="$TMPDIR/passwd.dummy"
+rm "$out/spool/etc/config.dummy"
+
+# Ensure all binaries are reachable within the spooling area.
+ln --symbolic --target-directory="$out/spool/bin/" "$out/bin/"*
diff --git a/pkgs/servers/hylafaxplus/post-patch.sh b/pkgs/servers/hylafaxplus/post-patch.sh
new file mode 100644
index 000000000000..6ec5937147e2
--- /dev/null
+++ b/pkgs/servers/hylafaxplus/post-patch.sh
@@ -0,0 +1,25 @@
+# `configure` (maybe others) set `POSIXLY_CORRECT`, which
+# breaks the gcc wrapper script of nixpkgs (maybe others).
+# We simply un-export `POSIXLY_CORRECT` after each export so
+# its effects don't apply within nixpkgs wrapper scripts.
+grep -rlF POSIXLY_CORRECT | xargs \
+  sed '/export *POSIXLY_CORRECT/a export -n POSIXLY_CORRECT' -i
+
+# Replace strange default value for the nobody account.
+if test -n "@maxuid@"
+then
+  for f in util/faxadduser.c hfaxd/manifest.h
+  do
+    substituteInPlace "$f" --replace 60002 "@maxuid@"
+  done
+fi
+
+# Replace hardcoded `PATH` variables with proper paths.
+# Note: `findutils` is needed for `faxcron`.
+substituteInPlace faxcover/edit-faxcover.sh.in \
+  --replace 'PATH=/bin' 'PATH="@faxcover_binpath@"'
+substituteInPlace etc/faxsetup.sh.in \
+  --replace 'PATH=/bin' 'PATH="@faxsetup_binpath@"'
+
+# Create `config.site`
+substitute "@configSite@" config.site --subst-var out
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 2fbddb94b1b7..e6d055848dce 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3196,6 +3196,8 @@ with pkgs;
 
   hwinfo = callPackage ../tools/system/hwinfo { };
 
+  hylafaxplus = callPackage ../servers/hylafaxplus { };
+
   i2c-tools = callPackage ../os-specific/linux/i2c-tools { };
 
   i2p = callPackage ../tools/networking/i2p {};