{ pkgs, lib, ... }:
{
  imports = [
    ../../common
    ./hardware-configuration.nix
  ];

  networking.hostName = "p14s";
  
  # secure boot shit
  environment.systemPackages = [ pkgs.sbctl ];
  boot.loader.systemd-boot.enable = lib.mkForce false;
  
  boot.lanzaboote = {
    enable = true;
    pkiBundle = "/var/lib/sbctl";
    autoGenerateKeys.enable = true;
    autoEnrollKeys = {
      enable = true;
      autoReboot = true;
    };
    configurationLimit = 5;
  }; 

  # swap & hibernate 
  boot.initrd.luks.devices."luks-d51bdb99-5966-40d3-a920-83ea78a73699" = {
    device = "/dev/disk/by-uuid/d51bdb99-5966-40d3-a920-83ea78a73699";
    crypttabExtraOpts = [ "tpm2-device=auto" ];
  };
  boot.kernelParams = [ "resume=/dev/disk/by-uuid/d51bdb99-5966-40d3-a920-83ea78a73699" ];
  
  # vm definition
  virtualisation.vmVariant = {
    virtualisation = {
      memorySize = 8192;
      cores = 6;
    };

    environment.systemPackages = with pkgs; [
      spice-vdagent
    ];
  };

  system.stateVersion = "26.05"; # yes
}