{secret, ...}: let
  nfsOptions = [
    "noauto"
    "X-mount.mkdir"
    "x-systemd.device-timeout=10"
    "timeo=14"
    "soft"
    "noatime"
    "x-systemd.after=wireguard-wg0.target"
    "x-systemd.wants=wireguard-wg0.target"
  ];

  blowholeAddress = secret.network.ips.blowhole.dns or "";
in {
  fileSystems = {
    "/" = {
      device = "heater-zpool/local/root";
      fsType = "zfs";
    };

    "/nix" = {
      device = "heater-zpool/local/nix";
      fsType = "zfs";
    };

    "/home" = {
      device = "heater-zpool/safe/home";
      fsType = "zfs";
    };

    "/var/lib/nomad" = {
      device = "heater-zpool/persist/nomad";
      fsType = "zfs";
    };

    "/var/lib/syncthing" = {
      device = "heater-zpool/persist/syncthing";
      fsType = "zfs";
    };

    "/etc/vault-agent" = {
      device = "heater-zpool/persist/vault-agent";
      fsType = "zfs";
    };

    "/boot" = {
      device = "/dev/disk/by-uuid/5e590840-9e62-4231-8ac5-e6a27325254d";
      fsType = "ext4";
    };

    "/boot/EFI" = {
      device = "/dev/disk/by-uuid/D381-9D12";
      fsType = "vfat";
    };

    "/mnt/cartman" = {
      device = "${blowholeAddress}:/mnt/cartman";
      fsType = "nfs";
      options = nfsOptions;
    };

    "/mnt/kyle" = {
      device = "${blowholeAddress}:/mnt/kyle";
      fsType = "nfs";
      options = nfsOptions;
    };

    "/mnt/stan" = {
      device = "${blowholeAddress}:/mnt/stan";
      fsType = "nfs";
      options = nfsOptions;
    };
  };

  swapDevices = [];
}