anchor.diff:              cryptsetup    # luks
               mtools        # disk labelling
               smartmontools # disk monitoring
  +            lm_sensors    # fan monitoring
               procps        # ps, top, pidof, vmstat, slabtop, skill, w
               psmisc        # fuser, killall, pstree, peekfd
               shadow        # passwd, su
  
positive.code:         # at no point is the ESP ever available to the kernel, unless it mounts it directly
          # the ESP is only accessed by the UEFI firmware to load the gummiboot bootloader, which sets it up as /
  
          boot.kernelModules = [ "kvm-intel" ];
  
          boot.supportedFilesystems = [ "zfs" ];
  
  
negative.code: 
          # Encrypted LUKS key will be stored as a gzipped cpio archive image
          # This allows us to use single password unlock
          boot.initrd.prepend = [ "${./secrets/luks_key.img.cpio.gz}" ];
  
          # make sure to decrypt our luks-key.img virtual block device first
          boot.initrd.luks.devices = 
  