{
  config,
  inputs',
  lib,
  config',
  pkgs,
  ...
}: let
  inherit
    (lib)
    singleton
    ;
in {
  imports = [inputs'.uterranix.nixosModules.default];

  uterranix.config = {
    config,
    tflib,
    ...
  }: let
    inherit
      (tflib)
      tf
      ;
  in {
    terraform.required_providers =
      config'.flake.uterranix.config.${pkgs.stdenv.system}.terraform.required_providers;

    imports = config'.uterranix.modules;

    resource."vault_consul_secret_backend_role"."envoy-grafana" = {
      name = "envoy-grafana";

      backend = "consul";

      service_identities = [
        "grafana"
        "influx"
        "telegraf"
      ];

      node_identities = singleton "blowhole:homelab-1";
    };

    resource."consul_acl_policy"."envoy-blowhole" = {
      name = "envoy-blowhole";
      datacenters = singleton "homelab-1";

      rules = ''
        mesh = "write"
      '';
    };

    resource."vault_consul_secret_backend_role"."envoy-blowhole" = {
      name = "envoy-blowhole";
      backend = "consul";

      consul_policies = singleton (tf "consul_acl_policy.envoy-blowhole.name");

      service_identities = singleton "telegraf-blowhole";

      node_identities = [
        "blowhole:homelab-1"
      ];
    };

    resource."vault_consul_secret_backend_role"."envoy-klipper" = {
      name = "envoy-klipper";

      backend = "consul";

      service_identities = singleton "mainsail";

      node_identities = singleton "blowhole:homelab-1";
    };
  };
}