{ config, lib, pkgs, modulesPath, ... }:
{
  boot = {
    kernelPackages = pkgs.linuxPackages_hardened;
    initrd.systemd.services.root-reset.enable = lib.mkForce false;
    swraid = {
      enable = true;
      mdadmConf = "MAILADDR contact@${config.domains.p2}";
    };
  };
}