{ config, lib, pkgs, ... }:

{
  boot = {
    initrd = {
      luks.devices = {
        nvm0.device = "/dev/disk/by-uuid/fe641e81-0812-4181-a5f6-382ebba509bb";
        nvm1.device = "/dev/disk/by-uuid/43df1ba8-1728-4193-8855-920a82d4494a";
      };
      luks.cryptoModules = [ "aes" "aes_generic" "blowfish" "twofish" "serpent" "cbc" "xts" "lrw" "sha1" "sha256" "sha512" "af_alg" "algif_skcipher" ] ++ [ "authenc" "ccm" "cmac" ];
      availableKernelModules = [ "drbg" "nvme" "fbcon" "xhci_pci" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" ];
      kernelModules = [ "dm-raid" "dm-integrity" "dm-snapshot" ];
    };

    blacklistedKernelModules = [ "nouveau" ];

    # Use the systemd-boot EFI boot loader.
    loader = {
      systemd-boot.enable = true;
      efi.canTouchEfiVariables = true;
      timeout = null;
    };

    plymouth.enable = true;

    kernelPackages = pkgs.linuxPackages_latest;
    kernelParams = [ "i915.fastboot=1" "intel_pstate=no_hwp" "acpi_backlight=vendor" "thinkpad-acpi.brightness_enable=1" "quiet" ];

    tmpOnTmpfs = true;
  };
}