{
  config,
  elib,
  vars,
  config',
  ...
}: let
  inherit
    (elib)
    nfsVolume
    nomadJob
    ;
in {
  resource."nomad_volume"."hydra-db" = nfsVolume {
    volume_name = "hydra-db";
    access_mode = "single-node-writer";
    server = "blowhole.hosts.in.redalder.org";
    share = "/mnt/jimmy/infrastructure/hydra/postgresql";
    mount_flags = ["nfsvers=3" "hard" "async"];
  };

  resource."nomad_volume"."hydra-data" = nfsVolume {
    volume_name = "hydra-data";
    access_mode = "single-node-writer";
    server = "blowhole.hosts.in.redalder.org";
    share = "/mnt/kyle/infrastructure/hydra/data";
    mount_flags = ["nfsvers=3" "hard" "async"];
  };

  resource."nomad_volume"."hydra-nix" = nfsVolume {
    volume_name = "hydra-nix";
    access_mode = "single-node-writer";
    server = "blowhole.hosts.in.redalder.org";
    share = "/var/nfs/hydra-nix";
    mount_flags = ["nfsvers=3" "hard" "async"];
  };

  resource."vault_policy"."hydra-policy" = {
    name = "hydra-policy";
    policy = ''
      path "kv/data/cluster/hydra" {
        capabilities = ["read"]
      }
    '';
  };

  resource."nomad_job"."hydra" = nomadJob {
    jobspec = ./job.hcl;

    vars = {
      flake_ref = "${vars.flake_host}?rev=${vars.flake_rev}&ref=${vars.flake_ref}";
      flake_sha = vars.flake_sha;
      store_path = builtins.toJSON (builtins.mapAttrs (_: builtins.unsafeDiscardStringContext) {
        hydra = config'.flake.nixngConfigurations.hydra.config.system.build.toplevel;
        postgresql = config'.flake.nixngConfigurations.hydraPostgreSQL.config.system.build.toplevel;
      });
    };
  };
}