{ config, lib, ... }:
{
  imports = [ ./user ];

  config = lib.mkIf config.services.nfs.server.enable {
    services.nfs.server.exports = "/storage *(rw,sync,no_subtree_check)";
    networking.firewall.extraInputRules = "ip saddr { 11.0.0.0/8, ${config.secrets.ips.bun} } tcp dport 2049 accept";
  };
}