{ modulesPath, ... }:
{
  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
  boot.loader = {
    efi.efiSysMountPoint = "/boot/efi";
    grub = {
      efiSupport = true;
      efiInstallAsRemovable = true;
      device = "nodev";
    };
  };
  fileSystems."/boot/efi" = { device = "/dev/disk/by-uuid/39A5-C7B9"; fsType = "vfat"; };
  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi" ];
  boot.initrd.kernelModules = [ "nvme" ];
  fileSystems."/" = { device = "/dev/sda1"; fsType = "ext4"; };

  # 150G Hetzner volume (scsi-0HC_Volume_106342723) — holds the Rust build trees, which repeatedly
  # filled the 75G root. A full disk here does NOT error: it silently truncates whatever is being
  # written (it destroyed a plan file mid-write before anyone noticed).
  #
  # by-uuid, not /dev/sdb: device names are not stable across reboots and attaching another volume
  # would silently mount the wrong disk here.
  #
  # nofail is REQUIRED, not decoration: without it, a detached/failed volume makes the mount unit a
  # boot dependency, systemd drops to emergency mode, and the box comes up WITHOUT SSH. That failure
  # has already happened once on this host from a bad nixos config, and it needed a recovery to the
  # previous generation. The build cache is not worth risking access to the machine.
  fileSystems."/mnt/data" = {
    device = "/dev/disk/by-uuid/16cd6650-1399-4cb9-a696-54b70d83203a";
    fsType = "ext4";
    options = [ "defaults" "nofail" "x-systemd.device-timeout=10s" ];
  };
}