initial commit

marks

@@ -0,0 +1,15 @@
+installation:
+secure erase / sanitize
+gdisk
+cryptsetup
+mkfs
+mount
+copy private files
+mkswap -s $SIZE -F /mnt/var/swapfile
+swapon /mnt/var/swapfile
+sbctl enroll-keys --yes-this-might-brick-my-machine
+nixos-install --flake "/mnt/etc/nixos#nixos" --no-channel-copy --no-root-passwd
+systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+2+7 <LUKS_DEV>
+
+todo:
+- lanzaboote