fix some issues

hosts/apollo/boot.nix

@@ -3,7 +3,22 @@
 {
   boot.initrd = {
     supportedFilesystems = [ "ext4" "zfs" ];
-    systemd.enable = true;
+    systemd = {
+      enable = true;
+      fido2.enable = true;
+      mounts = [
+        {
+          what = "/sysroot/keys";
+          where = "/keys";
+          type = "none";
+          options = "bind";
+          unitConfig.RequiresMountsFor = "/sysroot/keys";
+          requires = [ "sysroot-keys.mount" ];
+          after = [ "sysroot-keys.mount" ];
+          before = [ "zfs-import-nix-root.service" ];
+        }
+      ];
+    };
     luks.fido2Support = false;
 
     luks.devices."zfs-keys" = {
@@ -11,18 +26,18 @@
       crypttabExtraOpts = [ "fido2-device=auto" ];
     };
 
-    fileSystems."/keys" = {
-      device = "/dev/mapper/zfs-keys";
-      fsType = "ext4";
-      neededForBoot = true;
-    };
-
     systemd.services."zfs-import-nix-root" = {
       wants = [ "keys.mount" ];
       after = [ "keys.mount" ];
     };
   };
 
+  fileSystems."/keys" = {
+    device = "/dev/mapper/zfs-keys";
+    fsType = "ext4";
+    neededForBoot = true;
+  };
+
   boot.zfs.forceImportRoot = false;
   fileSystems."/" = {
     device = "nix-root/root";
@@ -50,6 +65,11 @@
     options = [ "fmask=0022" "dmask=0022" ];
   };
 
-  swapDevices = [ { device = "/dev/disk/by-id/nvme-CT1000P2SSD8_2138E5D5DA5A-part3"; } ];
+  swapDevices = [ 
+    {
+      device = "/dev/disk/by-id/nvme-CT1000P2SSD8_2138E5D5DA5A-part3"; 
+      randomEncryption.enable = true;
+    }
+  ];
   
 }