{pkgs, ...}: {
  environment.persistence."/persist" = {
    hideMounts = true;
    directories = [
      "/etc/secureboot"
      "/etc/ssh"
      "/etc/secrets"
      "/etc/NetworkManager/system-connections"

      "/var/log"
      "/var/lib"
      "/var/db/sudo"
    ];
    files = [
      "/etc/machine-id"
    ];

    users.min = {
      directories = [
        # cli tools
        {
          directory = ".gnupg";
          mode = "0700";
        }
        {
          directory = ".ssh";
          mode = "0700";
        }
        ".local/share/direnv"
        ".local/share/zoxide"
        ".local/share/nix" # trusted settings
        ".local/state/wireplumber" # volumes, etc

        # apps
        ".config/vesktop"
        ".librewolf"

        # languages
        ".cargo"

        # generic folders
        "Documents"
        "Downloads"
        "Videos"
        "Pictures"
        # TODO: "Music" should probably be mounted via NFS
        "p"
      ];
      files = [
        ".zsh_history"
      ];
    };
  };
  environment.systemPackages = [pkgs.ncdu];

  services.btrfs.autoScrub.enable = true;

  fileSystems = {
    "/".neededForBoot = true;
    "/etc/ssh" = {
      depends = ["/persist"];
      neededForBoot = true;
    };
    "/persist".neededForBoot = true; # no further config is needed, disko handles the rest
  };
}