4 files changed, 104 insertions, 10 deletions
diff --git a/hosts/threshold/default.nix b/hosts/tacitus/default.nix
index 485997b..1efc539 100644
--- a/hosts/threshold/default.nix
+++ b/hosts/tacitus/default.nix
@@ -3,7 +3,6 @@
   ...
 }:
 {
-
   imports = [
     ./network.nix
     ./disko.nix
@@ -17,18 +16,22 @@
 
   # Bootloader and boot setup.
   boot.loader.efi.canTouchEfiVariables = lib.mkDefault true;
-
-  boot.loader.grub = {
-    enable = true;
-    useOSProber = false;
-    device = "nodev";
+  boot.loader.limine = {
     efiSupport = true;
-    default = "saved";
-    memtest86.enable = true;
+    enable = true;
+    secureBoot = {
+      enable = true;
+      autoGenerateKeys = true;
+      autoEnrollKeys = {
+        extraArgs = [
+          "--microsoft"
+          "--firmware-builtin"
+        ];
+      };
+    };
   };
-
   # Networking setup
-  networking.hostName = "threshold";
+  networking.hostName = "tacitus";
   services.resolved = {
     enable = true;
     settings.Resolve.DNSOverTLS = "opportunistic";
diff --git a/hosts/tacitus/disko.nix b/hosts/tacitus/disko.nix
new file mode 100644
index 0000000..5e36661
--- /dev/null
+++ b/hosts/tacitus/disko.nix
@@ -0,0 +1,91 @@
+{ config, lib, ... }:
+{
+  options.host-config.disko = with lib; {
+    root_device = mkOption {
+      type = types.path;
+      default = "/dev/nvme0n1";
+      example = "/dev/nvme0n1";
+      description = "Root device for disko and grub";
+    };
+    enable = mkOption {
+      type = types.bool;
+      default = !config.addons.virtualisation.isTestVM;
+      description = "Whenever to enable disko or not.";
+    };
+  };
+
+  config =
+    let
+      cfg = config.host-config.disko;
+    in
+    lib.mkIf (cfg.enable) {
+      services.btrfs.autoScrub = {
+        enable = true;
+        interval = "weekly";
+      };
+
+      disko.devices = {
+        disk = {
+          main-disk = {
+            device = cfg.root_device;
+            type = "disk";
+            content = {
+              type = "gpt";
+              partitions = {
+                ESP = {
+                  type = "EF00";
+                  size = "512M";
+                  content = {
+                    type = "filesystem";
+                    format = "vfat";
+                    mountpoint = "/boot";
+                    mountOptions = [ "umask=0077" ];
+                  };
+                };
+                luks = {
+                  size = "100%";
+                  content = {
+                    type = "luks";
+                    name = "crypted";
+                    passwordFile = "/tmp/root-reserve-key.key";
+                    # Do not wait for recovery displaying and blocking formatting.
+                    content = {
+                      type = "btrfs";
+                      extraArgs = [ "-f" ];
+                      subvolumes = {
+                        # Subvolume name is different from mountpoint
+                        "/rootfs" = {
+                          mountOptions = [ "compress=zstd" ];
+                          mountpoint = "/";
+                        };
+                        # Subvolume name is the same as the mountpoint
+                        "/home" = {
+                          mountOptions = [ "compress=zstd" ];
+                          mountpoint = "/home";
+                        };
+                        # Parent is not mounted so the mountpoint must be set
+                        "/nix" = {
+                          mountOptions = [
+                            "compress=zstd"
+                            "noatime"
+                          ];
+                          mountpoint = "/nix";
+                        };
+                        # Subvolume for the swapfile
+                        "/swap" = {
+                          mountpoint = "/.swapvol";
+                          swap = {
+                            swapfile.size = "8G";
+                          };
+                        };
+                      };
+                    };
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    };
+}
diff --git a/hosts/threshold/hardware.nix b/hosts/tacitus/hardware.nix
index f0b2fe7..f0b2fe7 100644
--- a/hosts/threshold/hardware.nix
+++ b/hosts/tacitus/hardware.nix
diff --git a/hosts/threshold/network.nix b/hosts/tacitus/network.nix
index a4d0c03..a4d0c03 100644
--- a/hosts/threshold/network.nix
+++ b/hosts/tacitus/network.nix