{...}: let
  stage1Modules = [
    "aesni_intel"
    "kvm-intel"
    "aes_x86_64"

    "xhci_pci"
    "hxci_hcd"
  ];
in {
  # TASK: new device
  hardware.opinionatedDisk = {
    enable = true;
    encrypted = true;
    diskId = "ata-TOSHIBA_MK1652GSX_Y8B9CL6XT";
  };

  # boot.initrd.availableKernelModules = stage1Modules;
  boot.initrd.kernelModules = stage1Modules;
  boot.extraModprobeConfig = "";
}