{...}: {
  config.flake.modules.homeManager.nextcloud = {
    lib,
    config,
    pkgs,
    ...
  }: let
    mountDir = "synced-docs";
    remoteSubfolder = "synced-docs";
    remoteName = "ncsynceddocs";
    remoteNameEnv = lib.toUpper remoteName;
    # rclone's webdav backend needs the account's Nextcloud *user ID*, not
    # its login name, in the /dav/files/<uid>/ path -- the two differ on
    # this server. The login name ("aner") still goes in the `user` field
    # for Basic Auth. Both the uid and password come from `pass` at service
    # start, same as mbsync in features/mail, so neither lands in the Nix
    # store.
    #
    # Shares the azos-card-present silent presence check (overlays/default.nix)
    # with the mail sync timer: loop quietly until the YubiKey is plugged in
    # (no pinentry prompt either way), then exec rclone in the foreground.
    # Restart=always means unplugging/replugging the key remounts naturally.
    nextcloudMountSafe = pkgs.writeShellScript "nextcloud-mount-safe" ''
      set -eu
      mountpoint="$HOME/${mountDir}"
      mkdir -p "$mountpoint"
      while ! ${pkgs.azos-card-present}/bin/azos-card-present; do
        sleep 10
      done
      password=$(${pkgs.pass}/bin/pass zakobar.com | head -1)
      uid=$(${pkgs.pass}/bin/pass nextcloud-username/aner | head -1)
      export RCLONE_CONFIG_${remoteNameEnv}_TYPE=webdav
      export RCLONE_CONFIG_${remoteNameEnv}_URL="https://nextcloud.zakobar.com/remote.php/dav/files/$uid/"
      export RCLONE_CONFIG_${remoteNameEnv}_VENDOR=nextcloud
      export RCLONE_CONFIG_${remoteNameEnv}_USER=aner
      export RCLONE_CONFIG_${remoteNameEnv}_PASS="$(${pkgs.rclone}/bin/rclone obscure "$password")"
      exec ${pkgs.rclone}/bin/rclone mount ${remoteName}:${remoteSubfolder} "$mountpoint" \
        --vfs-cache-mode writes
    '';
  in {
    options.azos.nextcloud-client.enable = lib.mkOption {
      default = true;
      type = lib.types.bool;
    };
    options.azos.nextcloud-mount.enable = lib.mkOption {
      default = true;
      type = lib.types.bool;
    };
    config = lib.mkMerge [
      (lib.mkIf config.azos.nextcloud-client.enable {
        home.packages = with pkgs; [nextcloud-client];
        services.nextcloud-client = {
          enable = true;
          startInBackground = false;
        };
      })
      (lib.mkIf config.azos.nextcloud-mount.enable {
        home.packages = with pkgs; [rclone];
        # default.target, not graphical-session.target: the latter never
        # activates under EXWM in this setup (nothing explicitly starts it),
        # which is why nextcloud-client itself silently never autostarts.
        systemd.user.services.nextcloud-mount = {
          Unit.Description = "Mount Nextcloud ${remoteSubfolder} via rclone (waits silently for YubiKey)";
          Service = {
            Type = "simple";
            Environment = "PATH=${pkgs.fuse3}/bin:${pkgs.fuse}/bin";
            ExecStart = "${nextcloudMountSafe}";
            ExecStop = "${pkgs.fuse3}/bin/fusermount3 -u %h/${mountDir}";
            Restart = "always";
            RestartSec = "10s";
          };
          Install.WantedBy = ["default.target"];
        };
      })
    ];
  };
}