{pkgs, ...}: let
  external_drive_data = import ../../../data/raspberry_ext_drive.nix {};

  mount_external_drive = let
    jq = "${pkgs.jq}/bin/jq";
    vault = "${pkgs.vault-bin}/bin/vault";
    cryptsetup = "${pkgs.cryptsetup}/bin/cryptsetup";
  in
    pkgs.writeShellScriptBin "mount_external_drive" ''
      ${unmount_external_drive}/bin/unmount_external_drive

      vault-login

      ${vault} kv get -format json "/private-public-keys/cryptsetup/raspberry-ext-drive" \
        | ${jq} -r ".data.data.key" \
        | base64 -d \
        | ${cryptsetup} open ${external_drive_data.encrypted_path} ${external_drive_data.mapper_name} --key-file=/dev/stdin
      mount ${external_drive_data.mapper_path} -o rw,compress=zstd ${external_drive_data.mountpoint}
    '';

  unmount_external_drive = let
    cryptsetup = "${pkgs.cryptsetup}/bin/cryptsetup";
  in
    pkgs.writeShellScriptBin "unmount_external_drive" ''
      umount -flR ${external_drive_data.mountpoint} || true
      ${cryptsetup} close ${external_drive_data.mapper_name} || true
    '';
in {
  environment.systemPackages =
    (with pkgs; [
      cryptsetup
    ])
    ++ [
      mount_external_drive
      unmount_external_drive
    ];

  systemd.tmpfiles.rules = ["d ${external_drive_data.mountpoint} - root root"];

  # services.udev.extraRules = ''
  #   ACTION=="add", ENV{PARTNAME}=="${external_drive_data.encrypted_partlabel}", ENV{SYSTEMD_WANTS}="mount-external-drive.service"
  #   ACTION=="remove", ENV{PARTNAME}=="${external_drive_data.encrypted_partlabel}", ENV{SYSTEMD_WANTS}="unmount-external-drive.service"
  # '';
}