{ lib, config, ... }: {
  options = {
    custom = {
      dataDisk.enable = lib.mkOption {
        default = false;
        type = lib.types.bool;
        description = ''
          Whether to automatically mount /dev/sda1 on /mnt/data
        '';
      };

      ssh = {
        hostCert = lib.mkOption {
          type = lib.types.str;
          description = ''
            SSH host certificate
          '';
        };

        userCert = lib.mkOption {
          type = lib.types.str;
          description = ''
            SSH user certificate
          '';
        };

        hostKey = lib.mkOption {
          default = ../secrets/${config.networking.hostName}_host_ed25519.age;
          type = lib.types.path;
          description = ''
            SSH host key
          '';
        };

        userKey = lib.mkOption {
          default = ../secrets/${config.networking.hostName}_user_ed25519.age;
          type = lib.types.path;
          description = ''
            SSH user key
          '';
        };
      };
    };
  };

  config = {
    fileSystems."/dev/data" =
      lib.mkIf config.custom.dataDisk.enable { device = "/dev/sda1"; };
  };
}