{ config, lib, pkgs, vars, ... }:

let
  # `x-systemd.automount` never works inside a Linux container (LXC
  # included, regardless of privilege) -- confirmed live on lxc-docker:
  # systemd logs "Starting of <unit>.automount unsupported" for every
  # share and never mounts them. Mount eagerly there instead, with
  # `nofail` so a boot with the NFS server unreachable doesn't hang
  # (the VM platforms rely on automount itself to get that same
  # non-blocking behavior, so they don't need `nofail` too).
  automountOpts = if config.boot.isContainer then [ "nofail" ] else [ "x-systemd.automount" ];

  # A bare hostname here never resolves reliably: systemd-resolved only
  # ever tries LLMNR for single-label names (never DNS, regardless of any
  # configured search domain), and a *global* search domain (the first fix
  # attempted here) backfires worse -- confirmed live on lxc-docker, adding
  # `networking.search` made systemd-resolved prioritize its domain-matched
  # but server-less global scope over eth0's correctly-configured one for
  # every "*.sweet.home" query, silently sending them to public fallback
  # DNS instead. `resolvectl query --interface=eth0 server.sweet.home`
  # resolved fine throughout, proving the LAN DNS server was never the
  # problem -- only the ambient, unqualified device string was. Using the
  # FQDN directly sidesteps all of that, matching the pattern
  # ../raspi/mount-data.nix already uses for the same reason.
  nfsServer = "${vars.nfsServerHost}.${vars.homeDomain}";
in
{
  fileSystems = {
    ${vars.nfsShares.dockerConfig.mountpoint} = {
      device = "${nfsServer}:${vars.storageRoot}/${vars.nfsShares.dockerConfig.subpath}";
      fsType = "nfs";

      options = [
        "nfsvers=4.2"
        "_netdev"
        "noatime"
      ] ++ automountOpts;
    };

    ${vars.nfsShares.dockerDatabases.mountpoint} = {
      device = "${nfsServer}:${vars.storageRoot}/${vars.nfsShares.dockerDatabases.subpath}";
      fsType = "nfs";

      options = [
        "nfsvers=4.2"
        "_netdev"
        "noatime"
      ] ++ automountOpts;
    };

    ${vars.nfsShares.dockerVolumes.mountpoint} = {
      device = "${nfsServer}:${vars.storageRoot}/${vars.nfsShares.dockerVolumes.subpath}";
      fsType = "nfs";

      options = [
        "nfsvers=4.2"
        "_netdev"
        "noatime"
      ] ++ automountOpts;
    };

    ${vars.nfsShares.nextcloudData.mountpoint} = {
      device = "${nfsServer}:${vars.storageRoot}/${vars.nfsShares.nextcloudData.subpath}";
      fsType = "nfs";

      options = [
        "nfsvers=4.2"
        "_netdev"
        "noatime"
      ] ++ automountOpts;
    };

    ${vars.nfsShares.raspiVolumes.mountpoint} = {
      device = "${nfsServer}:${vars.storageRoot}/${vars.nfsShares.raspiVolumes.subpath}";
      fsType = "nfs";

      options = [
        "nfsvers=4.2"
        "_netdev"
        "noatime"
      ] ++ automountOpts;
    };
  };
}