{ secret, ... }:
let
  nfsOptions = [
    "noauto"
    "X-mount.mkdir"
    "x-systemd.device-timeout=10"
    "timeo=14"
    "soft"
    "noatime"
    "x-systemd.after=wireguard-wg0.target"
    "x-systemd.wants=wireguard-wg0.target"
  ];

  blowholeAddress = secret.network.ips.blowhole.dns or "";
in
{
  fileSystems = {
    "/" = {
      device = "omen-ssd/local/root";
      fsType = "zfs";
    };
    "/nix" = {
      device = "omen-ssd/local/nix";
      fsType = "zfs";
    };
    "/home" = {
      device = "omen-ssd/safe/home";
      fsType = "zfs";
    };

    "/boot/1" = {
      device = "/dev/disk/by-uuid/14647e24-3421-4398-b30e-537de6472433";
      fsType = "ext4";
    };
    "/boot/1/EFI" = {
      device = "/dev/disk/by-uuid/C58B-3BF8";
      fsType = "vfat";
    };

    "/var/lib/secrets" = {
      device = "omen-ssd/local/secrets";
      fsType = "zfs";
    };

    "/mnt/net/kyle" = {
      fsType = "nfs";
      device = "${blowholeAddress}:/mnt/kyle";
      options = nfsOptions;
    };
    "/mnt/net/cartman" = {
      fsType = "nfs";
      device = "${blowholeAddress}:/mnt/cartman";
      options = nfsOptions;
    };
    "/mnt/net/stan" = {
      fsType = "nfs";
      device = "${blowholeAddress}:/mnt/stan";
      options = nfsOptions;
    };
    "/mnt/net/getmail.d" = {
      fsType = "nfs";
      device = "${blowholeAddress}:/var/nfs/getmail/getmail.d";
      options = nfsOptions;
    };
    "/mnt/net/mail-configuration" = {
      fsType = "nfs";
      device = "${blowholeAddress}:/var/nfs/mail-configuration";
      options = nfsOptions;
    };
  };
}