might work might now idk

.vscode/settings.json

@@ -0,0 +1,3 @@
+{
+  "cSpell.enabled": false
+}

flake.lock

@@ -0,0 +1,68 @@
+{
+  "nodes": {
+    "disko": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1781152676,
+        "narHash": "sha256-RxWs5ND31KzTG7wvMM+PMfUjyNpmIEr999lqNARaM5o=",
+        "owner": "nix-community",
+        "repo": "disko",
+        "rev": "ff8702b4de27f72b4c78573dfb89ec74e36abdf1",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "disko",
+        "type": "github"
+      }
+    },
+    "home-manager": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1782051614,
+        "narHash": "sha256-xBRAhYLEXcjp8hM2tkkTTLb6PWU7VDxDoogl25g7Ezs=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "d1ccd0721ec599866622665f3651e19e6e2d4c6a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1781577229,
+        "narHash": "sha256-lrp67w8AulE9Ks53n27I45ADSzbOCn4H+CNW1Ck8B+8=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "567a49d1913ce81ac6e9582e3553dd90a955875f",
+        "type": "github"
+      },
+      "original": {
+        "id": "nixpkgs",
+        "ref": "nixos-unstable",
+        "type": "indirect"
+      }
+    },
+    "root": {
+      "inputs": {
+        "disko": "disko",
+        "home-manager": "home-manager",
+        "nixpkgs": "nixpkgs"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

flake.nix

@@ -0,0 +1,52 @@
+{
+  inputs = {
+    nixpkgs.url = "nixpkgs/nixos-unstable";
+
+    disko = {
+      url = "github:nix-community/disko";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    home-manager = {
+      url = "github:nix-community/home-manager";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+  };
+
+  outputs =
+    {
+      self,
+      nixpkgs,
+      disko,
+      home-manager,
+      ...
+    }:
+    let
+      system = "x86_64-linux";
+    in
+    {
+      nixosConfigurations.laptop = nixpkgs.lib.nixosSystem {
+        inherit system;
+
+        specialArgs = {
+          disk = "/dev/disk/by-id/REPLACE_ME"; # 👈 change at install time
+        };
+
+        modules = [
+          disko.nixosModules.disko
+
+          ./hosts/laptop/disko.nix
+          ./hosts/laptop/configuration.nix
+
+          home-manager.nixosModules.home-manager
+
+          {
+            home-manager.useGlobalPkgs = true;
+            home-manager.useUserPackages = true;
+
+            home-manager.users.river = import ./home;
+          }
+        ];
+      };
+    };
+}

hosts/laptop/configuration.nix

@@ -0,0 +1,96 @@
+{ config, pkgs, ... }:
+
+{
+  imports = [
+    ./hardware-configuration.nix
+    ./disko.nix
+  ];
+
+  boot = {
+    supportedFilesystems = [ "zfs" ];
+    loader = {
+      initrd = {
+        systemd.enable = true;
+
+        luks.devices."cryptroot" = {
+          device = "/dev/disk/by-partlabel/luks";
+          allowDiscards = true;
+        };
+
+        initrd.availableKernelModules = [
+          "tpm_tis"
+          "tpm_crb"
+        ];
+      };
+      efi.canTouchEfiVariables = true;
+    };
+    kernelModules = [
+      "tpm_tis"
+      "tpm_crb"
+    ];
+  };
+
+  security = {
+    tpm2.enable = true;
+    sudo.wheelNeedsPassword = false;
+  };
+
+  networking = {
+    hostName = "laptop";
+    networkmanager.enable = true;
+
+    firewall = {
+      enable = true;
+
+      allowPing = true;
+
+      allowedTCPPorts = [ 22 80 ];
+      allowedUDPPorts = [ 51820 ];
+    }
+  };
+
+  time.timeZone = "America/Chicago";
+
+  services.zfs.autoScrub.enable = true;
+  services.zfs.autoSnapshot.enable = true;
+
+  networking.hostId = "8425e349";
+
+  users.users.river = {
+    isNormalUser = true;
+    extraGroups = [
+      "wheel"
+      "networkmanager"
+      "podman"
+    ];
+  };
+
+  environment.systemPackages = with pkgs; [
+    git
+    neovim
+    btop
+    unzip
+    tpm2-tools
+  ];
+
+  nix.gc = {
+    automatic = true;
+    dates = "weekly";
+    options = "--delete-older-than 7d";
+  };
+
+  nix.settings.auto-optimise-store = true;
+
+  services.openssh = {
+    enable = true;
+    settings.PermitRootLogin = "no";
+  };
+
+  services.pipewire = {
+    enable = true;
+    pulse.enable = true;
+    alsa.enable = true;
+  };
+
+  system.stateVersion = "26.05";
+}

hosts/laptop/disko.nix

@@ -0,0 +1,72 @@
+{ disk, ... }:
+
+{
+  disko.devices.disk.main = {
+    type = "disk";
+    device = disk;
+    content = {
+      type = "gpt";
+
+      partitions = {
+        ESP = {
+          size = "1G";
+          type = "EF00";
+
+          content = {
+            type = "filesystem";
+            format = "vfat";
+            mountpoint = "/boot";
+          };
+        };
+
+        luks = {
+          size = "100%";
+
+          content = {
+            type = "luks";
+            name = "cryptroot";
+
+            # important: allow TPM-based unlocking
+            settings = {
+              allowDiscards = true;
+            };
+
+            # this is key for TPM workflows
+            initrdUnlock = true;
+
+            content = {
+              type = "zfs";
+              pool = "rpool";
+            };
+          };
+        };
+      };
+    };
+  };
+
+  zpool.rpool = {
+    type = "zpool";
+
+    rootFsOptions = {
+      compression = "zstd";
+      "com.sun:auto-snapshot" = "true";
+    };
+
+    datasets = {
+      root = {
+        type = "zfs_fs";
+        mountpoint = "/";
+      };
+
+      nix = {
+        type = "zfs_fs";
+        mountpoint = "/nix";
+      };
+
+      home = {
+        type = "zfs_fs";
+        mountpoint = "/home";
+      };
+    };
+  };
+}