{ lib, pkgs, ... }:
let
  configLimit = 50;
  kernel = pkgs.linuxPackages; # linuxPackages_latest;
in
{
  # Configure bootloader with lanzaboot and secureboot
  boot = {
    kernelModules = [ "nct6775" ];
    loader = {
      systemd-boot = {
        enable = false;
        configurationLimit = configLimit;
      };

      efi = {
        canTouchEfiVariables = true;
        efiSysMountPoint = "/boot";
      };
    };

    kernel.sysctl = {
      "net.ipv4.ip_forward" = 1;
      "net.ipv6.conf.all.forwarding" = 1;
      "vm.swappiness" = 60;
    };

    # Override kernel to latest
    kernelPackages = kernel;

    kernelParams = [
      "nohibernate"
    ];

    consoleLogLevel = 3;
    bootspec.enable = true;

    plymouth.enable = lib.mkForce false;

    initrd = {
      kernelModules = [
        "tpm"
        "tpm_tis"
        "tpm_crb"
        "tpm_infineon"
      ];
      systemd = {
        enable = true;
        # tpm2.enable = true;
        tpm2.enable = true;
      };
      clevis = {
        enable = true;
        devices = {
#          "/dev/sde:/dev/sdf:/dev/sdh:/dev/sdi:/dev/sdj".secretFile = "../../../pool.jwe";
        };
      };
    };

    # Enable binfmt emulation for ARM
    binfmt.emulatedSystems = [ "aarch64-linux" ]; # --argstr system aarch64-linux
  };

  zramSwap = {
    enable = true;
  };
}