{ lib, config, ... }: {
  nixpkgs.hostPlatform = "x86_64-linux";
  hardware.enableRedistributableFirmware = true;

  boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" ];
  boot.initrd.kernelModules = [ "usb_storage" ];
  boot.kernelModules = [ "usb_storage" ];
  boot.extraModulePackages = [ ];

  #  age.secrets.tureis_user_password = {
  #  rekeyFile = ./secrets/password.age;
  #  owner = "user";
  #  group = "users";
  #  mode = "0400";
  # };
  
  n.host = {
    # hardware.cpu = "intel"; # TODO
    bootloader = "lanzaboote";

    hostId = "db4713ee";
    users."user" = lib.mkUser "" true;
    defaultUser = "user";
    types = [ "desktop" ];
  };

  imports = [
    (lib.fs.luks "nix" "/dev/sda4" {})

    (lib.fs.tmpfs "/" "none" [ "mode=755" "size=40%" ])
    (lib.fs.vfat "/boot" "/dev/disk/by-uuid/5B0A-68EA" [ "fmask=0022" "dmask=0022" ])
    (lib.fs.ext4 "/nix" "/dev/mapper/nix" null)
  ];

  boot.initrd.supportedFilesystems.vfat = true;
}