11 files changed, 572 insertions, 0 deletions
diff --git a/hosts/by-name/apzu/configuration.nix b/hosts/by-name/apzu/configuration.nix
new file mode 100644
index 00000000..fe5be0af
--- /dev/null
+++ b/hosts/by-name/apzu/configuration.nix
@@ -0,0 +1,72 @@
+# nixos-config - My current NixOS configuration
+#
+# Copyright (C) 2025 Benedikt Peetz <benedikt.peetz@b-peetz.de>
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# This file is part of my nixos-config.
+#
+# You should have received a copy of the License along with this program.
+# If not, see <https://www.gnu.org/licenses/gpl-3.0.txt>.
+{...}: {
+  imports = [
+    ./hardware.nix
+    ../../../modules/common/soispha
+  ];
+
+  vhack.users = {
+    enable = true;
+    users = [
+      {
+        name = "soispha";
+        groups = ["wheel" "audio"];
+        enableDeprecatedPlugdev = true;
+        uid = 1000;
+        sshKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIME4ZVa+IoZf6T3U08JG93i6QIAJ4amm7mkBzO14JSkz";
+        hashedPassword = "$y$jFT$3qI9MYLDHPUdGKsVa8skV0$TOjX0SFHWuj52zd7/kmkNtG5EqQwYcqv0FKXWbLaro6";
+      }
+    ];
+  };
+
+  soispha = {
+    bluetooth.enable = true;
+
+    laptop = {
+      backlight = "intel_backlight";
+      enable = true;
+    };
+
+    power.enable = true;
+
+    programs = {
+      starship.showBattery = true;
+
+      ly.batteryName = "BAT0";
+
+      river.init = {
+        mappings = {
+          layout = "dvorak-modified";
+        };
+        screenSetupCode = {};
+      };
+    };
+
+    locale.enable = true;
+    networking = {
+      enable = true;
+      hostName = "apzu";
+      mode = "NetworkManager";
+    };
+
+    services = {
+      unison.foreign.address = "tiamat.fritz.box";
+      upower.enable = true;
+    };
+
+    nixpkgs = {
+      enable = true;
+      systemName = "x86_64-linux";
+    };
+  };
+
+  system.stateVersion = "23.05";
+}
diff --git a/hosts/by-name/apzu/hardware.nix b/hosts/by-name/apzu/hardware.nix
new file mode 100644
index 00000000..a90476c5
--- /dev/null
+++ b/hosts/by-name/apzu/hardware.nix
@@ -0,0 +1,44 @@
+# nixos-config - My current NixOS configuration
+#
+# Copyright (C) 2025 Benedikt Peetz <benedikt.peetz@b-peetz.de>
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# This file is part of my nixos-config.
+#
+# You should have received a copy of the License along with this program.
+# If not, see <https://www.gnu.org/licenses/gpl-3.0.txt>.
+{modulesPath, ...}: {
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix") # TODO: is this necessary?
+  ];
+
+  soispha = {
+    boot.enableIsoEntry = false;
+
+    disks = {
+      enable = true;
+      disk = "/dev/disk/by-id/nvme-INTEL_SSDPEKNU512GZH_PHKA1481032A512A_1";
+      ssd = true;
+      swap = {
+        ram_size = "16G";
+      };
+    };
+
+    hardware = {
+      enable = true;
+      cpuType = "intel";
+    };
+  };
+
+  boot = {
+    kernelModules = ["kvm-intel"];
+
+    kernelParams = [
+      # Use the newer experimental xe driver
+      # "i915.force_probe=!9a49"
+      # "xe.force_probe=9a49"
+    ];
+
+    initrd.availableKernelModules = ["xhci_pci" "vmd" "nvme" "usb_storage" "sd_mod" "rtsx_pci_sdmmc"];
+  };
+}
diff --git a/hosts/by-name/apzu/host.toml b/hosts/by-name/apzu/host.toml
new file mode 100644
index 00000000..9e975618
--- /dev/null
+++ b/hosts/by-name/apzu/host.toml
@@ -0,0 +1,2 @@
+hostname = "apzu.fritzbox.com"
+nixpkgs = "unstable"
diff --git a/hosts/by-name/apzu/secrets/local/repository_password.age b/hosts/by-name/apzu/secrets/local/repository_password.age
new file mode 100644
index 00000000..b1508e49
--- /dev/null
+++ b/hosts/by-name/apzu/secrets/local/repository_password.age
@@ -0,0 +1,20 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqVCtBZzNBWFlxQnhlb3c2
+NG0xMjV3V2hQUWhNb01ROGpFbzM0c3NjRWlvCjRqMTdxNlNsY1lDM2VCUGRjcldZ
+SUhScGRSejY3TFlwVjlweTRERkU4ZTQKLT4gc3NoLWVkMjU1MTkgelpFb25nIGtj
+cVN4RzFseTJCVXhOc0tEWi96ckpGQjhNdUZrb1FVWnJ6TU1vSHZCMUkKc1JwM2Ir
+TzNzZEV5VEE4QUp4cDdTNWZvTFlZR0tUbUFZTnNEZE1McnhISQotPiBzc2gtZWQy
+NTUxOSA3SGZGVXcgYVQzRHdaa1NYUUpLODUyL0orV3d4Z1o1V2hhekZXVWFzNW50
+enhSYnlWbwpzbnZwK1dSczJ5SGZsRjNyRWZraUcreWlBakZOZkVyZ01CWml5V0E4
+TzY4Ci0+ICpMUC1ncmVhc2UgV0IKUTZVMzR1QTVGdWRyNWprVVpjaWhCTTFSRzY3
+bHVtdHpJQXlWQVFHZ3FzbkZncHRsQnJIaHlEekl5ZE15Sko0YQpSVEUKLS0tIGFy
+N1Y2OUREY1NOL2xPODd4Y3Y4Wk83NFJ5ZVBpNnJYelo3RmZPL1V4Q28KcA+6qt2d
+LrL0FS279XL1uqSeXiDdBBBh5i951dRx9ML33g7IoQxaGqSWU0yP/y7fcSp3B/rT
+/alQGRL/uYnCS2z8zCngr2YCQBXAI8bOgf+th7fzc15FXNB14WMGvrCVRB8Rr6JZ
+itTxcAebY192xeINJG269iL6Ef0YrmZLUufKQ9lcVob/G32tG0vxSbSBBx3asf7y
+toiNdlXpxJPrIpFx5mc3dnkaXCTSRuXjiAqnncW/HNxovCI90sY3dyL+XRC8iEOD
+sql7C7jUUvLubptk1gGW5pHmGvqeCLr+fJ6XrVqXE5VxOSbzvSUsdS84WOBInLiO
+V36aUtthEzdRXd81P/n7U26O93GWpIwzctu0WwSHHHsPKhxqFY4RuWa3mO4Zk6fu
+O6fsYnpAqYiCUd/k2zKrDtLosTnwuwc7Vm1glm4DEEtvteVibw47SR1LLfUds5XL
+j1OR7Z6/ljIEKPjE1a81pQjYRfHDUtceXUvrlL6iCID30zU=
+-----END AGE ENCRYPTED FILE-----
diff --git a/hosts/by-name/apzu/secrets/storagebox/repository_password.age b/hosts/by-name/apzu/secrets/storagebox/repository_password.age
new file mode 100644
index 00000000..a2aa984a
--- /dev/null
+++ b/hosts/by-name/apzu/secrets/storagebox/repository_password.age
@@ -0,0 +1,14 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzbnJ5Z3NXRFRtdEdCNk1z
+NG9Cb2FUTEZ2U2hTdUptWGpneHd2RGxGQlY0ClhqcHlMSUZlLzBPZko4a2hKdnE1
+Q1hnc3ErWlJiSk1HVXFLcSswQlV0WTAKLT4gc3NoLWVkMjU1MTkgelpFb25nIG5I
+cFpMY21ZdU9TUHY5VksraG1xeFByQlM1WE1INEk0SWFJQzIvSXhZbXMKSWxiNlIr
+NjZ6bEgySUJGdnpoZTY2MmxxajJMaUVTM3RkTmhpdkxaRnNCQQotPiBzc2gtZWQy
+NTUxOSA3SGZGVXcgRGtLMHFORm9mUDUwZnBXM0djcFlxTExJbWVDeDJmbVVSRi9l
+QTFmekpROApZY3Z0Zlc1SUdCcllKQ01ZNmdFQkI3UnViVGxzNTJNUkhqc2hOejY3
+MndrCi0+IG1Hbi1ncmVhc2UgUDJJdgpGUmVHa1NPWGtzUmZmMXM3eWkxVnJkek1h
+MUxZeS9qMlArendXZ1ltdFgvMTBabTlPM2hzSjhuVXBQNktHKzc1ClF6bjZob09B
+Ci0tLSB3dEZpbnpVR0pPdGpFVmNyM0JzUGl6eGcreXpkTG9xQUc5S09ndUthaEpR
+CuHgXCIq/AUCuIQWepBRapAab6zczOwxEBpDv5R2kw2mw34UVRLuFs7hB1cHE79y
+7Fc=
+-----END AGE ENCRYPTED FILE-----
diff --git a/hosts/by-name/apzu/secrets/storagebox/ssh_key.age b/hosts/by-name/apzu/secrets/storagebox/ssh_key.age
new file mode 100644
index 00000000..a7f30c7c
--- /dev/null
+++ b/hosts/by-name/apzu/secrets/storagebox/ssh_key.age
@@ -0,0 +1,22 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJOTFaQVpnQ2VJN1pJbmdu
+STF2UTF1Y3lyU2p3OUJlcWRFWlg3Mm9vSEFFCjg4RklaZ0hqdWdZSlJ0dGx0ckJN
+eHE4R1QyTEJEVkZudnVQV2VpblBYTW8KLT4gc3NoLWVkMjU1MTkgelpFb25nIDR0
+Z2RwTXJGV1VYT2Y1OUcxbXpnOGNEbG9BWmFxeWUzZ1huNW1YQk5BM3cKK1hLNnYx
+VnNvRDZWM3Y4VUpCQTRtbHJOcDJLdTBOUXJ1ak52Mkp3TE9OcwotPiBzc2gtZWQy
+NTUxOSA3SGZGVXcgSHFSOXM1Vm1lY0ErRkZobndEU0xvQjVXbnhDbUlGNmE2dStY
+SEFqSk9TMAo2VU5UbW9rc29kendvcHNuU3hFQ2lBQWNjRUxUSE10RmtjbkdwWGlv
+cTRVCi0+IDwtZ3JlYXNlIHNPT3N1IHNkZzcoQzUgLUM3Ml1Tcgorb3FQcWlDSkJQ
+L1g4WisydkYxdnJMeDNISVVDTGlZdmUyRkV0TkFUdW4ycXZBSlF3UWM2R3FTYjRs
+ckEyaTg2ClVrbwotLS0gdHF5Q3BqV3h2TzEySCs4OFNIYmx1U0hsTWo1RDlTV3VC
+T1RmelZaWXh4YwoeRkYbirDGX9aZj6OVxZ8sVsm2Sz23ikcBhAdTIXKErM7eQcdp
+Y2nA5kUebPVznbSq/XSQNbqvCfSv9wVVTZWww7AqkrltjFS8yxQVMKB37IfnJsZI
+92OCjJKArxAbvS7ERKY51Cf9oY/VqGk5WqxExH5ZvdbL144UI8JzrxhDopVXBWNd
+fCrHirRAdlu3wgVILXV3vk1kmE69sspuV4cer5f/kOBKT1w09s2NFFHH4TO3cLTJ
+Obgi/HWYHBjqGSgwd4bDtNOW2UDE1LN3YeUhloutWhuX8yt+NFzZJtl+CBrRqLKA
+0CK+ZPKPWWKYPCNlzKT4vDF9BZeyCfoEj9dTXvxrNPEB6YYi16aQ8DhI8wxADl41
+ShrULlEmB8rfz7V+8TFmERKISBRSSH0p+XJi8e2DWh2dSco16rizmbFFNDdcYiGT
+WWbXYCFNzj+kNFI/vEtt9dEWmfXlgg01khnyoOuRLedtoCDSuF+8z7YYy6oYt/2h
+gmf4NHOUgyxK56c17JMQ3xT97d2odgqmwB+YZQ13IJCjt3M3pmSssD4sTgmA5alH
+vtUlci6dZdO801h5vOesbAJplXCEyw==
+-----END AGE ENCRYPTED FILE-----
diff --git a/hosts/by-name/tiamat/configuration.nix b/hosts/by-name/tiamat/configuration.nix
new file mode 100644
index 00000000..462bbe9a
--- /dev/null
+++ b/hosts/by-name/tiamat/configuration.nix
@@ -0,0 +1,86 @@
+# nixos-config - My current NixOS configuration
+#
+# Copyright (C) 2025 Benedikt Peetz <benedikt.peetz@b-peetz.de>
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# This file is part of my nixos-config.
+#
+# You should have received a copy of the License along with this program.
+# If not, see <https://www.gnu.org/licenses/gpl-3.0.txt>.
+{
+  lib,
+  system,
+  sources,
+  ...
+}: {
+  imports = [
+    ./hardware.nix
+  ];
+
+  vhack = {
+    # TODO: Hard-code all the uids/gids <2025-05-13>
+    persist.directories = [
+      "/var/lib/nixos"
+    ];
+    users = {
+      enable = true;
+      users = [
+        {
+          name = "soispha";
+          groups = ["wheel" "audio"];
+          enableDeprecatedPlugdev = true;
+          uid = 1000;
+          sshKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIME4ZVa+IoZf6T3U08JG93i6QIAJ4amm7mkBzO14JSkz";
+          hashedPassword = "$y$jFT$qi3wS9njrMl2y55b3NOBI0$j40Qt6AAkMSfZ82KPhqMaUaPztWtPps1wOqaXaF/L.6";
+        }
+      ];
+    };
+  };
+
+  soispha = {
+    bluetooth = {enable = true;};
+    networking = {
+      enable = true;
+      hostName = "tiamat";
+      mode = "systemd-networkd";
+    };
+    nixpkgs = {
+      enable = true;
+      systemName = "x86_64-linux";
+    };
+
+    services = {
+      unison.foreign.address = "apzu.fritz.box";
+    };
+    programs = {
+      river = {
+        unicodeInput.enable = true;
+        init = {
+          mappings = {
+            layout = "us";
+            keymap = {
+              # Support Unicode input
+              "<Alt+Ctrl+Meta+Shift-Z>" = [
+                "spawn"
+                "${lib.getExe sources.qmk_firmware.packages.${system}.qmk_unicode_type} 106 65377"
+              ];
+            };
+          };
+          screenSetupCode = {
+            "DP-2" = {pos = "2560,0";};
+            "DP-1" = {
+              scale = "1.5";
+              pos = "0,0";
+            };
+          };
+        };
+      };
+    };
+    locale = {
+      enable = true;
+      keyMap = "us";
+    };
+  };
+
+  system.stateVersion = "23.05";
+}
diff --git a/hosts/by-name/tiamat/hardware.nix b/hosts/by-name/tiamat/hardware.nix
new file mode 100644
index 00000000..f2a5cec6
--- /dev/null
+++ b/hosts/by-name/tiamat/hardware.nix
@@ -0,0 +1,47 @@
+# nixos-config - My current NixOS configuration
+#
+# Copyright (C) 2025 Benedikt Peetz <benedikt.peetz@b-peetz.de>
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# This file is part of my nixos-config.
+#
+# You should have received a copy of the License along with this program.
+# If not, see <https://www.gnu.org/licenses/gpl-3.0.txt>.
+{modulesPath, ...}: {
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix") # TODO: is this necessary?
+    ./legacy-disk-module/module.nix
+  ];
+
+  soispha = {
+    hardware = {
+      enable = true;
+      cpuType = "amd";
+      moonlander = {
+        enableFlashing = true;
+      };
+    };
+  };
+  legacy.soispha = {
+    disks = {
+      enable = true;
+      disk = "/dev/disk/by-id/nvme-CT1000P5SSD8_21032C857568";
+      ssd = true;
+      swap = {
+        uuid = "057b5041-6fee-4739-84a9-ade8f0f51519";
+        resumeOffset = "533760";
+      };
+    };
+  };
+
+  boot = {
+    kernelModules = ["kvm-amd"];
+
+    kernelParams = [
+      # Avoid loosing the Bluetooth controller to a sleep, from which it never wakes again
+      "btusb.enable_autosuspend=n"
+    ];
+
+    initrd.availableKernelModules = ["nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod"];
+  };
+}
diff --git a/hosts/by-name/tiamat/legacy-disk-module/fstrim.nix b/hosts/by-name/tiamat/legacy-disk-module/fstrim.nix
new file mode 100644
index 00000000..0fbb6c83
--- /dev/null
+++ b/hosts/by-name/tiamat/legacy-disk-module/fstrim.nix
@@ -0,0 +1,51 @@
+# nixos-config - My current NixOS configuration
+#
+# Copyright (C) 2025 Benedikt Peetz <benedikt.peetz@b-peetz.de>
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# This file is part of my nixos-config.
+#
+# You should have received a copy of the License along with this program.
+# If not, see <https://www.gnu.org/licenses/gpl-3.0.txt>.
+{
+  pkgs,
+  lib,
+  cfg,
+}: {
+  timers.fstrim = lib.mkIf cfg.ssd {
+    wantedBy = ["timers.target"];
+    wants = ["fstrim.service"];
+    unitConfig = {
+      Description = "Discard unused blocks once a week";
+      Documentation = "man:fstrim";
+      ConditionVirtualization = "!container";
+      ConditionPathExists = "!/etc/initrd-release";
+    };
+    timerConfig = {
+      OnCalendar = "weekly";
+      AccuracySec = "1h";
+      Persistent = "true";
+      RandomizedDelaySec = "6000";
+    };
+  };
+  services.fstrim = lib.mkIf cfg.ssd {
+    wantedBy = lib.mkForce [];
+    unitConfig = {
+      Description = "Discard unused blocks on filesystems from /etc/fstab";
+      Documentation = "man:fstrim(8)";
+      ConditionVirtualization = "!container";
+    };
+    serviceConfig = {
+      Type = "oneshot";
+      ExecStart = "${pkgs.util-linux}/bin/fstrim --listed-in /etc/fstab:/proc/self/mountinfo --verbose --quiet-unsupported";
+      PrivateDevices = "no";
+      PrivateNetwork = "yes";
+      PrivateUsers = "no";
+      ProtectKernelTunables = "yes";
+      ProtectKernelModules = "yes";
+      ProtectControlGroups = "yes";
+      MemoryDenyWriteExecute = "yes";
+      SystemCallFilter = "@default @file-system @basic-io @system-service";
+    };
+  };
+}
diff --git a/hosts/by-name/tiamat/legacy-disk-module/hibernate.nix b/hosts/by-name/tiamat/legacy-disk-module/hibernate.nix
new file mode 100644
index 00000000..d3f8fe8b
--- /dev/null
+++ b/hosts/by-name/tiamat/legacy-disk-module/hibernate.nix
@@ -0,0 +1,55 @@
+# nixos-config - My current NixOS configuration
+#
+# Copyright (C) 2025 Benedikt Peetz <benedikt.peetz@b-peetz.de>
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# This file is part of my nixos-config.
+#
+# You should have received a copy of the License along with this program.
+# If not, see <https://www.gnu.org/licenses/gpl-3.0.txt>.
+{pkgs}: {
+  services = {
+    hibernate-preparation = {
+      wantedBy = ["systemd-hibernate.service"];
+      unitConfig = {
+        Description = "Enable swap file and disable zram before hibernate";
+        Before = "systemd-hibernate.service";
+      };
+      serviceConfig = {
+        Type = "oneshot";
+        User = "root";
+        ExecStart = "${pkgs.bash}/bin/bash -c \"${pkgs.util-linux}/bin/swapon /swap/swapfile && ${pkgs.util-linux}/bin/swapoff /dev/zram0\"";
+      };
+    };
+
+    hibernate-resume = {
+      wantedBy = ["systemd-hibernate.service"];
+      unitConfig = {
+        Description = "Disable swap after resuming from hibernation";
+        After = "hibernate.target";
+      };
+      serviceConfig = {
+        Type = "oneshot";
+        User = "root";
+        ExecStart = "${pkgs.util-linux}/bin/swapoff /swap/swapfile";
+      };
+    };
+    # swapoff-start = {
+    #      wantedBy = ["multi-user.target"];
+    #      unitConfig = {
+    #        Description = "Disable hardware swap after booting";
+    #      };
+    #      serviceConfig = {
+    #        Type = "oneshot";
+    #        User = "root";
+    #        ExecStart = "${pkgs.util-linux}/bin/swapoff /swap/swapfile";
+    #      };
+    #    };
+    systemd-hibernate.serviceConfig.Environment = "SYSTEMD_BYPASS_HIBERNATION_MEMORY_CHECK=1";
+    systemd-logind.serviceConfig.Environment = "SYSTEMD_BYPASS_HIBERNATION_MEMORY_CHECK=1";
+  };
+
+  sleep.settings.Sleep = {
+    HibernateDelaySec = "10m";
+  };
+}
diff --git a/hosts/by-name/tiamat/legacy-disk-module/module.nix b/hosts/by-name/tiamat/legacy-disk-module/module.nix
new file mode 100644
index 00000000..8c49f6eb
--- /dev/null
+++ b/hosts/by-name/tiamat/legacy-disk-module/module.nix
@@ -0,0 +1,159 @@
+# nixos-config - My current NixOS configuration
+#
+# Copyright (C) 2025 Benedikt Peetz <benedikt.peetz@b-peetz.de>
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# This file is part of my nixos-config.
+#
+# You should have received a copy of the License along with this program.
+# If not, see <https://www.gnu.org/licenses/gpl-3.0.txt>.
+{
+  config,
+  lib,
+  pkgs,
+  extra_modules,
+  ...
+}: let
+  # FIXME: The iso redeploy requires a bigger efi partition  <2024-05-12>
+  cfg = config.legacy.soispha.disks;
+  defaultMountOptions = [
+    "compress=zstd:3" # This saves disk space, at a performance cost
+    "noatime" # should have some performance upsides, and I don't use it anyways
+    "lazytime" # make time changes in memory
+  ];
+in {
+  options.legacy.soispha.disks = {
+    enable = lib.mkEnableOption "disk setup with disko";
+
+    disk = lib.mkOption {
+      type = lib.types.path;
+      example = lib.literalExpression "/dev/disk/by-uuid/0442cb6d-f13a-4635-b487-fa76189774c5";
+      description = "The disk used for installing the OS.";
+    };
+
+    ssd = lib.mkEnableOption "ssd specific improvements, like trim";
+
+    swap = {
+      uuid = lib.mkOption {
+        type = lib.types.str;
+        example = lib.literalExpression "d1d20ae7-3d8a-44da-86da-677dbbb10c89";
+        description = "The uuid of the swapfile";
+      };
+      resumeOffset = lib.mkOption {
+        type = lib.types.str;
+        example = lib.literalExpression "134324224";
+        description = "The resume offset of the swapfile";
+      };
+    };
+  };
+
+  imports = [
+    extra_modules.nixos.disko
+  ];
+
+  config = lib.mkIf cfg.enable {
+    systemd = lib.recursiveUpdate (import ./hibernate.nix {inherit pkgs;}) (import ./fstrim.nix {inherit pkgs lib cfg;});
+
+    disko.devices = {
+      disk = {
+        main = {
+          device = cfg.disk;
+          content = {
+            type = "gpt";
+            partitions = {
+              root = {
+                size = "100%";
+                name = "root";
+                content = {
+                  type = "luks";
+                  name = "nixos";
+                  extraOpenArgs = ["--allow-discards"];
+                  content = {
+                    type = "btrfs";
+                    extraArgs = ["-f" "--label nixos"]; # Override existing partitions
+                    subvolumes = {
+                      "nix" = {
+                        mountpoint = "/nix";
+                        mountOptions = defaultMountOptions;
+                      };
+                      "persistent-storage" = {
+                        mountpoint = "/srv";
+                        mountOptions = defaultMountOptions;
+                      };
+                      "persistent-storage@snapshots" = {
+                        mountpoint = "/srv/.snapshots";
+                        mountOptions = defaultMountOptions;
+                      };
+                      "swap" = {
+                        mountpoint = "/swap";
+                        mountOptions = [
+                          "noatime" # should have some performance upsides, and I don't use it anyways
+                          "lazytime" # make time changes in memory
+                        ];
+                      };
+                    };
+                  };
+                };
+              };
+              boot = {
+                type = "EF00";
+                size = "512M";
+                name = "boot";
+                content = {
+                  type = "filesystem";
+                  format = "vfat";
+                  mountpoint = "/boot";
+                };
+              };
+            };
+          };
+        };
+      };
+      nodev = {
+        "/" = {
+          fsType = "tmpfs";
+          mountOptions = ["defaults" "size=25%" "mode=0755"];
+        };
+        "/tmp" = {
+          fsType = "tmpfs";
+          mountOptions = ["defaults" "size=50%" "mode=0755"];
+        };
+        "/nix/var/nix/b" = {
+          fsType = "tmpfs";
+          mountOptions = [
+            "defaults"
+            "noswap" # Otherwise, we might run into io-based slowdowns
+            "size=80%"
+            "mode=0755"
+          ];
+        };
+      };
+    };
+    fileSystems = {
+      "/srv" = {
+        neededForBoot = true;
+      };
+      "/swap" = {
+        neededForBoot = true;
+      };
+    };
+    swapDevices = [
+      #{
+      #        device = "/swap/swapfile";
+      #        priority = 1; # lower than zramSwap, just in case
+      #        # size = 2048; # TODO: can nixos create a btrfs swapfile correctly?
+      #}
+    ];
+    zramSwap = {
+      enable = true;
+      priority = 10; # needs to be higher than hardware-swap
+    };
+    boot = {
+      kernelParams = [
+        "resume_offset=${cfg.swap.resumeOffset}"
+        "zswap.enabled=0" # zswap and zram are not really compatible
+      ];
+      resumeDevice = "/dev/disk/by-uuid/${cfg.swap.uuid}";
+    };
+  };
+}