installation:
secure erase / sanitize
gdisk
cryptsetup
mkfs
mount
copy private files
mkswap -s $SIZE -F /mnt/var/swapfile
swapon /mnt/var/swapfile
sbctl enroll-keys --yes-this-might-brick-my-machine
nixos-install --flake "/mnt/etc/nixos#nixos" --no-channel-copy --no-root-passwd
systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+2+7 <LUKS_DEV>

todo:
- ssh-add, rspamd
- email tracking
- gitea, mediawiki