{...}: {
  # Every filesystem on shadow lives here, hand-maintained.
  #
  # hardware.nix is generated with `--no-filesystems` precisely so it never
  # emits fileSystems/swapDevices entries of its own. That keeps regeneration
  # (`nix run .#sync-hardware`) safe: re-running it can never clobber these
  # definitions, nor produce duplicates for whichever data drives happened to
  # be mounted at the time it ran.
  flake.nixosModules.shadowDisks = {...}: let
    # Secondary data drive, addressed by filesystem label.
    #
    # noauto + x-systemd.automount makes systemd generate an .automount unit and
    # mount on first access to the path rather than at boot — the two 2.7T
    # spinners stay parked until something actually touches them. idle-timeout
    # unmounts them again once quiet so they can spin back down.
    #
    # nofail matters even with automount: it stops a missing or dying disk from
    # becoming a failed dependency that drops the boot into emergency mode.
    #
    # On-disk ownership is already ahmza mode 755 on all three, so no uid mapping
    # is needed — ext4 stores ownership in the filesystem and ignores uid=/gid=.
    dataDrive = label: {
      device = "/dev/disk/by-label/${label}";
      fsType = "ext4";
      options = [
        "nofail"
        "noauto"
        "x-systemd.automount"
        "x-systemd.idle-timeout=600"
        "x-systemd.device-timeout=10"
      ];
    };
  in {
    fileSystems = {
      # Boot essentials, by UUID. UUIDs rather than labels here on purpose:
      # these two must resolve unambiguously, and a label is only as unique as
      # the last disk someone plugged in.
      "/" = {
        device = "/dev/disk/by-uuid/deff63fc-1738-4cfc-a79c-06e58c78471a";
        fsType = "ext4";
      };

      "/boot" = {
        device = "/dev/disk/by-uuid/5873-AD05";
        fsType = "vfat";
        options = ["fmask=0077" "dmask=0077"];
      };

      "/mnt/dump" = dataDrive "DUMP";
      "/mnt/games" = dataDrive "GAMES";
      "/mnt/bak" = dataDrive "BAK";
    };

    swapDevices = [];
  };
}