{ config, lib, pkgs, modulesPath, ... }:

{
  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];

  # === Boot options ===
  boot.initrd.availableKernelModules =
    [ "xhci_pci" "ehci_pci" "ahci" "usbhid" "uas" "usb_storage" "sd_mod" ];
  boot.initrd.kernelModules = [ ];
  boot.kernelModules = [ "kvm-intel" ];
  boot.extraModulePackages = [ ];

  # === Internal drive ===
  fileSystems."/" = {
    device = "zroot/safe/root";
    fsType = "zfs";
  };

  fileSystems."/nix" = {
    device = "zroot/local/nix";
    fsType = "zfs";
  };

  fileSystems."/var/log/journal" = {
    device = "zroot/safe/journal";
    fsType = "zfs";
  };

  fileSystems."/boot" = {
    device = "/dev/disk/by-uuid/8BB2-9DCB";
    fsType = "vfat";
  };

  # === Swap ===
  swapDevices =
    [{ device = "/dev/disk/by-uuid/efc7e294-1c18-4dd9-aca5-f868eb9c47fc"; }];
} // (
  # === External drives ===
  let
    cryptsetup = "${pkgs.cryptsetup}/bin/cryptsetup";
    unlockLuksService = label: keyfile: overwrites:
      lib.attrsets.recursiveUpdate {
        description = "Unlock luks encrypted device '${label}'";
        bindsTo = [ "dev-${label}.device" ];
        after = [ "dev-${label}.device" ];
        serviceConfig = {
          Type = "oneshot";
          RemainAfterExit = true;
          ExecStart = ''
            ${cryptsetup} luksOpen --key-file ${keyfile} /dev/${label} ${label}opened
          '';
          ExecStop = ''
            ${cryptsetup} luksClose ${label}opened
          '';
        };
      } overwrites;

    disks = {
      FRA = "8ae45289-82ed-4cf1-9d68-a0e26e5d9bb5";
      BER = "85ce2e58-72fc-4a66-a376-565bb4fc39a1";
      HND = "4a3765fc-155e-453d-a348-d1782447bcfe";
      LEJ = "5e3c2c1e-73f6-43e6-b8f3-71c923cbeb6d";
    };
  in {
    # Unlock all luks devices and import the zfs pools if necessary
    systemd.services."luks-open-FRA" =
      unlockLuksService "FRA" "/root/keys/fra" { };
    systemd.services."luks-open-BER" =
      unlockLuksService "BER" "/root/keys/ber" {
        serviceConfig.ExecStartPost = "${pkgs.zfs}/bin/zpool import zBER";
      };
    systemd.services."luks-open-HND" =
      unlockLuksService "HND" "/root/keys/hnd" {
        serviceConfig.ExecStartPost = "${pkgs.zfs}/bin/zpool import zHND";
      };
    systemd.services."luks-open-LEJ" =
      unlockLuksService "LEJ" "/root/keys/lej" { };

    systemd.mounts = [
      {
        what = "/dev/mapper/FRAopened";
        where = "/srv/fra";
        type = "ext4";
        wantedBy = [ "default.target" ];
        requires = [ "luks-open-FRA.service" ];
        after = [ "luks-open-FRA.service" ];
      }
      {
        what = "/dev/mapper/vg_lej-lv_lej";
        where = "/srv/lej";
        type = "ext4";
        wantedBy = [ "default.target" ];
        requires = [ "luks-open-LEJ.service" ];
        after = [ "luks-open-LEJ.service" ];
      }
    ];

    # Add udev rules for every disk
    services.udev.customRules = [{
      name = "85-rename-and-unlock-disks";
      rules = lib.concatStringsSep "\n" (lib.attrsets.mapAttrsToList
        (alias: uuid: ''
          SUBSYSTEM=="block", ENV{ID_FS_UUID}=="${uuid}", SYMLINK+="${alias}", TAG+="systemd"
        '') disks);
    }];

  })