machines/rana: enable full-disk encryption

machines/rana/disko.nix

@@ -53,6 +53,9 @@ in
       zroot = {
         type = "zpool";
         rootFsOptions = {
+          encryption = "aes-256-gcm";
+          keyformat = "passphrase";
+          keylocation = "file:///tmp/secret.key";
           mountpoint = "none";
           compression = "lz4";
           acltype = "posixacl";