{ netbootSystem, netbootMinimalSystem, ... }:

let
  # config.system.build.kernel and .netbootRamdisk are directories, not the
  # files themselves — nixpkgs' own system.build.kexecTree does the same
  # ${...}/<file> dereference for the same reason.
  mkStageRules = { dirName, system }:
    let
      inherit (system.config.system.boot.loader) kernelFile;
      dir = "/srv/pxe/http/${dirName}";
    in
    [
      # Declared here too (not just in build-types/pxe-boot.nix) so this
      # module's C+ rules don't depend on cross-module list-merge ordering —
      # tmpfiles' C type needs the target directory to already exist.
      "d ${dir} 0755 root root -"
      "C+ ${dir}/${kernelFile} 0644 root root - ${system.config.system.build.kernel}/${kernelFile}"
      "C+ ${dir}/initrd 0644 root root - ${system.config.system.build.netbootRamdisk}/initrd"
      "C+ ${dir}/netboot.ipxe 0644 root root - ${system.config.system.build.netbootIpxeScript}/netboot.ipxe"
    ];
in
{
  # Builds this flake's own installer netboot image (the same one
  # `nix build .#pxe` produces) plus the vanilla NixOS minimal netboot image
  # (`nix build .#pxe-minimal`), and stages both where menu.ipxe's
  # :auto-installer / :nixos-minimal entries expect them, so the pxe-boot
  # host is self-contained — no manual operator step to populate
  # /srv/pxe/http after deploy.
  systemd.tmpfiles.rules =
    mkStageRules { dirName = "auto-installer"; system = netbootSystem; }
    ++ mkStageRules { dirName = "nixos-minimal"; system = netbootMinimalSystem; };
}