Systemdification is real

hosts/micronix/system.nix

@@ -11,6 +11,33 @@
     generationsDir.copyKernels = true;
   };
 
+  boot.initrd = {
+    systemd = {
+      enable = true;
+      dbus = {
+        enable = true;
+      };
+      tpm2.enable = true;
+    };
+  };
+
+  boot.plymouth = {
+    enable = true;
+    theme = "tribar";
+  };
+
+  systemd = {
+    tpm2.enable = true;
+    sysupdate.enable = true;
+    oomd = {
+      enable = true;
+      enableRootSlice = true;
+      enableSystemSlice = true;
+      enableUserSlices = true;
+    };
+    enableStrictShellChecks = true;
+  };
+
   boot.kernelPackages = pkgs.linuxPackages_cachyos-lto;
 
   boot.kernelParams = [
@@ -26,7 +53,6 @@
     "debugfs=off"
     "oops=panic"
     "module.sig_enforce=1"
-    "lockdown=confidentiality"
     "mce=0"
     "quiet"
     "splash"
@@ -170,8 +196,6 @@
     forcePageTableIsolation = true;
   };
 
-  systemd.tpm2.enable = true;
-
   fonts = {
     enableGhostscriptFonts = true;
     enableDefaultPackages = true;