{...}: {
  environment.persistence."/persist" = {
    hideMounts = true;
    directories = [
      # "/etc/secureboot"
      "/etc/ssh"
      "/etc/secrets"

      "/var/log"
      "/var/lib/systemd/coredump"
      "/var/lib/nixos"
      "/var/lib/containers"
      "/var/db/sudo"

      "/var/lib/acme"

      "/srv"

      # k8s
      "/var/lib/containerd"
      "/var/lib/kubernetes"
      "/var/lib/kubelet"
      "/var/lib/kube-proxy"
    ];
    files = [
      "/etc/machine-id"
    ];
  };

  fileSystems = {
    "/".neededForBoot = true;
    "/etc/ssh" = {
      depends = ["/persist"];
      neededForBoot = true;
    };
    "/persist".neededForBoot = true; # no further config is needed, disko handles the rest
  };
}