From d8b20caf22bd9d53b4dda05ba3f22064a9448c0f Mon Sep 17 00:00:00 2001
From: kurogeek <kurogeek@lmvhaus.com>
Date: Tue, 24 Mar 2026 15:36:46 +0700
Subject: [PATCH] machines/rana: enable full-disk encryption

---
 machines/rana/disko.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/machines/rana/disko.nix b/machines/rana/disko.nix
index fbc082f..5153edd 100644
--- a/machines/rana/disko.nix
+++ b/machines/rana/disko.nix
@@ -53,6 +53,9 @@ in
       zroot = {
         type = "zpool";
         rootFsOptions = {
+          encryption = "aes-256-gcm";
+          keyformat = "passphrase";
+          keylocation = "file:///tmp/secret.key";
           mountpoint = "none";
           compression = "lz4";
           acltype = "posixacl";