{
  config,
  lib,
  pkgs,
  ...
}:
let
  cfg = config.personal.boot;
in
{
  options.personal.boot = {
    grub.enable = lib.mkEnableOption "grub";
    efi.enable = lib.mkEnableOption "EFI";
    unattendedReboot = lib.mkEnableOption "unattended reboots";
  };

  config = lib.mkMerge [
    (lib.mkIf cfg.grub.enable {
      boot.loader.grub = {
        enable = true;
        enableCryptodisk = config.boot.initrd.luks.devices != { };
        device = lib.mkDefault "nodev";
      };
    })
    (lib.mkIf cfg.efi.enable {
      boot.loader = {
        efi.canTouchEfiVariables = true;
        grub.efiSupport = true;
      };
    })
    (
      let
        crypt = config.personal.hardware.disks.crypted;
      in
      lib.mkIf (cfg.unattendedReboot && crypt != null) {
        boot.initrd = {
          secrets."/keyfile.luks" = /etc/luks/keys/tmp;
          luks.devices.crypt.keyFile = "/keyfile.luks";
        };
        systemd.services.luks-post-open = {
          description = "Run commands after LUKS unlock";
          wantedBy = [ "cryptsetup.target" ];
          after = [ "cryptsetup.target" ];
          serviceConfig.Type = "oneshot";
          path = [ pkgs.cryptsetup ];
          script = ''
            echo "Disabling temporary LUKS key file..."
            cryptsetup --verbose luksRemoveKey ${crypt} /etc/luks/keys/tmp;
          '';
        };
      }
    )
  ];
}