clean up home manager

hosts/apollo/boot.nix

@@ -3,7 +3,22 @@
 {
   boot.initrd = {
     supportedFilesystems = [ "ext4" "zfs" ];
-    systemd.enable = true;
+    systemd = {
+      enable = true;
+      fido2.enable = true;
+      mounts = [
+        {
+          what = "/sysroot/keys";
+          where = "/keys";
+          type = "none";
+          options = "bind";
+          unitConfig.RequiresMountsFor = "/sysroot/keys";
+          requires = [ "sysroot-keys.mount" ];
+          after = [ "sysroot-keys.mount" ];
+          before = [ "zfs-import-nix-root.service" ];
+        }
+      ];
+    };
     luks.fido2Support = false;
 
     luks.devices."zfs-keys" = {
@@ -11,18 +26,18 @@
       crypttabExtraOpts = [ "fido2-device=auto" ];
     };
 
-    fileSystems."/keys" = {
-      device = "/dev/mapper/zfs-keys";
-      fsType = "ext4";
-      neededForBoot = true;
-    };
-
     systemd.services."zfs-import-nix-root" = {
       wants = [ "keys.mount" ];
       after = [ "keys.mount" ];
     };
   };
 
+  fileSystems."/keys" = {
+    device = "/dev/mapper/zfs-keys";
+    fsType = "ext4";
+    neededForBoot = true;
+  };
+
   boot.zfs.forceImportRoot = false;
   fileSystems."/" = {
     device = "nix-root/root";
@@ -50,6 +65,11 @@
     options = [ "fmask=0022" "dmask=0022" ];
   };
 
-  swapDevices = [ { device = "/dev/disk/by-id/nvme-CT1000P2SSD8_2138E5D5DA5A-part3"; } ];
+  swapDevices = [ 
+    {
+      device = "/dev/disk/by-id/nvme-CT1000P2SSD8_2138E5D5DA5A-part3"; 
+      randomEncryption.enable = true;
+    }
+  ];
   
 }

modules/home/nyxerinys/default.nix

@@ -3,20 +3,22 @@
 {
   # Home Manager needs a bit of information about you and the
   # paths it should manage.
-  home.username = "nyxerinys";
-  home.homeDirectory = (
+  home = {
+    username = "nyxerinys";
+    homeDirectory = (
       if osConfig.nyxs-nix.services.home.isMacOS then
         "/Users/nyxerinys" 
       else
         "/home/nyxerinys"
     );
-  home.packages = with pkgs; [
+    packages = with pkgs; [
       prismlauncher
       sops
       age
       ssh-to-age
       tmux
     ];
+  };
 
 
   # This value determines the Home Manager release that your