diff --git a/terranix/containers/nfs-csi/controller.hcl b/terranix/containers/nfs-csi/controller.hcl
new file mode 100644
index 0000000..74355a8
--- /dev/null
+++ b/terranix/containers/nfs-csi/controller.hcl
@@ -0,0 +1,47 @@
+variable "datacenters" {
+  type = list(string)
+}
+
+job "democratic-csi-nfs-controller" {
+  datacenters = var.datacenters
+
+  group "controller" {
+    task "plugin" {
+      driver = "docker"
+
+      config {
+        image = "docker.io/democraticcsi/democratic-csi:latest"
+
+        args = [
+          "--csi-version=1.5.0",
+          # must match the csi_plugin.id attribute below
+          "--csi-name=org.democratic-csi.nfs",
+          "--driver-config-file=${NOMAD_TASK_DIR}/driver-config-file.yaml",
+          "--log-level=info",
+          "--csi-mode=controller",
+          "--server-socket=/csi/csi.sock",
+        ]
+      }
+
+      template {
+        destination = "${NOMAD_TASK_DIR}/driver-config-file.yaml"
+
+        data = <<EOH
+driver: node-manual
+EOH
+      }
+
+      csi_plugin {
+        # must match --csi-name arg
+        id        = "org.democratic-csi.nfs"
+        type      = "controller"
+        mount_dir = "/csi"
+      }
+
+      resources {
+        cpu    = 500
+        memory = 256
+      }
+    }
+  }
+}
diff --git a/terranix/containers/nfs-csi/default.nix b/terranix/containers/nfs-csi/default.nix
new file mode 100644
index 0000000..8db764e
--- /dev/null
+++ b/terranix/containers/nfs-csi/default.nix
@@ -0,0 +1,26 @@
+{ elib, ... }:
+let
+  inherit (elib)
+    nomadJob;
+  datacenters = builtins.toJSON [
+    "do-1"
+    "homelab-1"
+  ];
+in
+{
+  resource."nomad_job"."nfs-controller" = nomadJob {
+    jobspec = ./controller.hcl;
+
+    vars = {
+      inherit datacenters;
+    };
+  };
+
+  resource."nomad_job"."nfs-node" = nomadJob {
+    jobspec = ./node.hcl;
+
+    vars = {
+      inherit datacenters;
+    };
+  };
+}
diff --git a/terranix/containers/nfs-csi/node.hcl b/terranix/containers/nfs-csi/node.hcl
new file mode 100644
index 0000000..a19e5f2
--- /dev/null
+++ b/terranix/containers/nfs-csi/node.hcl
@@ -0,0 +1,59 @@
+variable "datacenters" {
+  type = list(string)
+}
+
+job "democratic-csi-nfs-node" {
+  datacenters = var.datacenters
+
+  type = "system"
+
+  group "nodes" {
+    task "plugin" {
+      driver = "docker"
+
+      env {
+        CSI_NODE_ID = "${attr.unique.hostname}"
+      }
+
+      config {
+        image = "docker.io/democraticcsi/democratic-csi:latest"
+
+        args = [
+          "--csi-version=1.5.0",
+          # must match the csi_plugin.id attribute below
+          "--csi-name=org.democratic-csi.nfs",
+          "--driver-config-file=${NOMAD_TASK_DIR}/driver-config-file.yaml",
+          "--log-level=info",
+          "--csi-mode=node",
+          "--server-socket=/csi/csi.sock",
+        ]
+
+        # node plugins must run as privileged jobs because they
+        # mount disks to the host
+        privileged = true
+        ipc_mode = "host"
+        network_mode = "host"
+      }
+
+      template {
+        destination = "${NOMAD_TASK_DIR}/driver-config-file.yaml"
+
+        data = <<EOH
+driver: node-manual
+EOH
+      }
+
+      csi_plugin {
+        # must match --csi-name arg
+        id        = "org.democratic-csi.nfs"
+        type      = "node"
+        mount_dir = "/csi"
+      }
+
+      resources {
+        cpu    = 500
+        memory = 256
+      }
+    }
+  }
+}