{
  elib,
  tflib,
  secret,
  vars,
  config',
  ...
}: let
  inherit
    (elib)
    nfsVolume
    nomadJob
    ;
  inherit
    (tflib)
    tf
    ;
in {
  terraform.required_providers = {
    nomad = {
      source = "hashicorp/nomad";
      configuration_aliases = ["nomad.do-1"];
    };
  };

  resource."nomad_volume"."ingress-letsencrypt" = nfsVolume {
    provider = "nomad.do-1";
    volume_name = "ingress-letsencrypt";
    access_mode = "single-node-writer";
    server = secret.network.ips.blowhole.ip or "";
    share = "/mnt/kyle/infrastructure/ingress-toothpick/letsencrypt";
    mount_flags = ["nolock" "hard"];
  };

  imports = [
    (elib.buildNixNGSystem {
      name = "ingressToothpick";
      hosts = [
        "toothpick.hosts.in.redalder.org"
      ];
    })
  ];

  resource."nomad_job"."ingress" = nomadJob {
    jobspec = ./job.hcl;
    vars = {
      flake_ref = "unused";
      flake_sha = "unused";
      store_path = tf "data.external.nixng-system-ingressToothpick.result.out";
      upstreams = "\${file(\"${./upstreams.conf}\")}";
    };

    depends_on = [
      "terraform_data.nixng-system-ingressToothpick-copy"
    ];
  };
}