{ config, ... }:
{
  flake.modules.homeManager.sharepoint-reference =
    {
      config,
      lib,
      pkgs,
      ...
    }:
    let
      rcloneConfig = "${config.xdg.configHome}/rclone/rclone.conf";
      destination = "${config.xdg.dataHome}/yookr-reference/sharepoint";
      libraries = {
        Algemeen = "company-sharepoint:";
        Projecten = "company-sharepoint-projecten:";
      };
    in
    {
      systemd.user.services = lib.mapAttrs' (
        name: remote:
        lib.nameValuePair "sharepoint-reference-${lib.toLower name}" {
          Unit = {
            Description = "SharePoint ${name} on-demand reference mount";
            ConditionPathExists = rcloneConfig;
          };

          Service = {
            Type = "notify";
            UMask = "0077";
            Environment = "PATH=/run/wrappers/bin:${lib.makeBinPath [ pkgs.fuse3 ]}";
            ExecStartPre = "${pkgs.coreutils}/bin/mkdir -p ${destination}/${name}";
            # Stream reads into memory; never retain file contents in a disk cache.
            # Keep the mount read-only, matching its role as reference material.
            ExecStart = "${lib.getExe pkgs.rclone} mount ${remote} ${destination}/${name} --config ${rcloneConfig} --read-only --vfs-cache-mode off --buffer-size 16M --dir-cache-time 5m --umask 077";
            Restart = "on-failure";
            RestartSec = "30s";
          };

          Install.WantedBy = [ "default.target" ];
        }
      ) libraries;
    };

  flake.modules.nixos.sharepoint-reference = {
    home-manager.sharedModules = [ config.flake.modules.homeManager.sharepoint-reference ];
  };
}