{
  boot.loader.grub.device = "/dev/sda";
  boot.initrd.luks.devices."sda2".device = "/dev/sda2";
  services.btrfs.autoScrub.enable = true;
  services.btrfs.autoScrub.interval = "weekly";

  disko.devices.disk.sda = {
    device = "/dev/sda";
    content = {
      type = "table";
      format = "gpt";
      partitions = [ 
        {
          name = "BOOT";
          start = "0%";
          end = "550MiB";
          bootable = true;
          flags = [ "esp" ];
          fs-type = "fat32";
          content = {
            type = "filesystem";
            format = "vfat";
            mountpoint = "/boot";
          };
        } # partition 1
        { 
          name = "LUKS";
          start = "550MiB";
          end = "100%";
          content = {
            type = "luks";
            name = "LUKS-ROOT";
            extraOpenArgs = [ "--allow-discards" ];
            settings.keyFile = "/tmp/secret.key";
            content = {
              type = "btrfs";
              extraArgs = [ "-f" ];
              subvolumes = {
                "@" = {
                  mountpoint = "/";
                  mountOptions = [ "compress=zstd" "noatime" ];
                }; # root
              }; # subvolumes
            }; # content.content
          }; # content
        } # partition 2
      ]; # partitions
    }; # content
  }; # disko.devices.disk.sda
} # root