{ ... }:

{
  # TASK: new device
  hardware.encryptedDisk = {
    enable = true;
    diskId = "nvme-SAMSUNG_MZVLW256HEHP-000L7_S35ENX0K827498";
  };

  boot.initrd.availableKernelModules = [
    "aesni_intel"
    "kvm-intel"
    "aes_x86_64"
  ];

  boot.extraModprobeConfig = ''
    options kvm-intel nested=1
    options kvm-intel enable_shadow_vmcs=1
    options kvm-intel enable_apicv=1
    options kvm-intel ept=1
  '';
}