{ elib, secret, vars, config', ... }:
let
  inherit (elib)
    nfsVolume
    nomadJob;
in
{
  resource."nomad_volume"."ingress-letsencrypt" = nfsVolume {
    volume_name = "ingress-letsencrypt";
    access_mode = "single-node-writer";
    server = secret.network.ips.blowhole.ip;
    share = "/var/nfs/ingress-letsencrypt";
    mount_flags = [ "nolock" "hard" ];
  };

  resource."nomad_job"."ingress" = nomadJob {
    jobspec = ./job.hcl;
    vars = {
      flake_ref = "${vars.flake_host}?rev=${vars.flake_rev}&ref=${vars.flake_ref}";
      flake_sha = vars.flake_sha;
      store_path = config'.flake.nixngConfigurations.ingressToothpick.config.system.build.toplevel;
      upstreams = "\${file(\"${./upstreams.conf}\")}";
    };
  };
}