{ config, lib, pkgs, vars, ... }:

let
  # `x-systemd.automount` never works inside a Linux container (LXC
  # included, regardless of privilege) -- confirmed live on lxc-docker:
  # systemd logs "Starting of <unit>.automount unsupported" for every
  # share and never mounts them. Mount eagerly there instead, with
  # `nofail` so a boot with the NFS server unreachable doesn't hang
  # (the VM platforms rely on automount itself to get that same
  # non-blocking behavior, so they don't need `nofail` too).
  automountOpts = if config.boot.isContainer then [ "nofail" ] else [ "x-systemd.automount" ];

  # FQDN in the storage.home zone — resolves to the Pacemaker vip-storage
  # (192.168.20.229) on docker's eth1/vmbr2 interface. Using the DNS name
  # rather than the raw IP means a future VIP renumber only requires a DNS
  # update, not a NixOS rebuild. The storage.home zone is served by the same
  # FreeIPA nameserver (domainControllerIp) that docker already uses, so
  # resolution reaches it over eth0 without any extra routing.
  nfsServer = vars.haStorageNfsFqdn;
  storageRoot = vars.haStorageRoot;
in
{
  fileSystems = {
    ${vars.nfsShares.dockerConfig.mountpoint} = {
      device = "${nfsServer}:${storageRoot}/${vars.nfsShares.dockerConfig.subpath}";
      fsType = "nfs";

      options = [
        "nfsvers=4.2"
        "_netdev"
        "noatime"
      ] ++ automountOpts;
    };

    ${vars.nfsShares.dockerDatabases.mountpoint} = {
      device = "${nfsServer}:${storageRoot}/${vars.nfsShares.dockerDatabases.subpath}";
      fsType = "nfs";

      options = [
        "nfsvers=4.2"
        "_netdev"
        "noatime"
      ] ++ automountOpts;
    };

    ${vars.nfsShares.dockerVolumes.mountpoint} = {
      device = "${nfsServer}:${storageRoot}/${vars.nfsShares.dockerVolumes.subpath}";
      fsType = "nfs";

      options = [
        "nfsvers=4.2"
        "_netdev"
        "noatime"
      ] ++ automountOpts;
    };

    ${vars.nfsShares.nextcloudData.mountpoint} = {
      device = "${nfsServer}:${storageRoot}/${vars.nfsShares.nextcloudData.subpath}";
      fsType = "nfs";

      options = [
        "nfsvers=4.2"
        "_netdev"
        "noatime"
      ] ++ automountOpts;
    };

    ${vars.nfsShares.raspiVolumes.mountpoint} = {
      device = "${nfsServer}:${storageRoot}/${vars.nfsShares.raspiVolumes.subpath}";
      fsType = "nfs";

      options = [
        "nfsvers=4.2"
        "_netdev"
        "noatime"
      ] ++ automountOpts;
    };
  };
}