set -euo pipefail
gdisk $DISK
mkfs.fat -F 32 $ESPPART
cryptsetup luksFormat $ROOTPART
cryptsetup open $ROOTPART root
mkfs.ext4 $ROOTPART
mount /dev/mapper/root /mnt
mount $ESPPART --mkdir -o umask=077 /mnt/boot
mkdir /mnt/var
mkswap -F -s $SWAPSIZE /mnt/var/swapfile
swapon /mnt/var/swapfile
mkdir -p /mnt/etc/nixos
nixos-generate-config --root /mnt --kernel latest --flake
#copy backup
nixos-install --no-root-passwd --no-channel-copy --flake "/mnt/etc/nixos#nixos"
sbctl enroll-keys --yes-this-might-brick-my-machine
systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+2+7 $ROOTPART