{ config, lib, vars, ... }:

let
  # FQDN of the LAN NFS VIP (Pacemaker vip-lan, 192.168.2.229). Using the
  # FQDN rather than a raw IP or bare hostname avoids systemd-resolved LLMNR
  # quirks and survives a future VIP renumber via a DNS-only update.
  nfsServer = "ha-vip-lan.${vars.homeDomain}";
in
{
  fileSystems.${vars.nfsShares.pxebootImages.mountpoint} = {
    device = "${nfsServer}:${vars.haStorageRoot}/${vars.nfsShares.pxebootImages.subpath}";
    fsType = "nfs";
    options = [
      "_netdev"
      "noatime"
    ] ++ (if config.boot.isContainer
    # NFSv4 requires rpc_pipefs (sunrpc filesystem), which Proxmox LXC
    # containers block unless `features: mount=nfs` is set. Use NFSv3+nolock
    # instead: no rpc_pipefs dependency at the protocol level, and rpcbind
    # on the server handles port resolution without needing client-side
    # sunrpc infrastructure. nofail keeps boot clean if server is unreachable.
    then [ "nfsvers=3" "proto=tcp" "nolock" "nofail" ]
    else [ "nfsvers=4.2" "x-systemd.automount" ]);
  };

  # NixOS pulls var-lib-nfs-rpc_pipefs.mount (the sunrpc filesystem) into
  # nfs-client.target for any nfs fileSystems entry. In LXC containers the
  # sunrpc mount is blocked by Proxmox's AppArmor profile, causing it to fail
  # and the activation to report an error even though our mount uses nofail.
  # Add ConditionVirtualization=!container via drop-in so systemd skips the
  # unit entirely in containers (skip = inactive, not failed), which keeps
  # nfs-client.target green and activation clean.
  systemd.units = lib.mkIf config.boot.isContainer {
    "var-lib-nfs-rpc_pipefs.mount" = {
      overrideStrategy = "asDropin";
      text = ''
        [Unit]
        ConditionVirtualization=!container
      '';
    };
  };
}