system.luks: init for setting performance defaults

system/default.nix

@@ -13,6 +13,7 @@ in
   imports = [
     ./lix.nix
     ./nix.nix
+    ./luks.nix
   ];
 
   options.nixowos.${name} = {
@@ -30,6 +31,7 @@ in
     nixowos.${name} = {
       lix.enable = true;
       nix.enable = true;
+      luks.enable = true;
     };
 
     environment.systemPackages = cfg.extraPackages;

system/luks.nix

@@ -0,0 +1,42 @@
+{
+  lib,
+  config,
+  ...
+}:
+
+let
+  name = "luks";
+  cfg = config.nixowos.system.${name};
+in
+{
+  options.nixowos.system.${name} = {
+    enable = lib.mkEnableOption name;
+  };
+
+  options.boot.initrd.luks.devices = lib.mkOption {
+    type = lib.types.attrsOf (
+      lib.types.submodule {
+        config = lib.mkIf cfg.enable (
+          lib.mkDefault {
+            # Setting "true" here is a major performance improvement to LUKS at least on SSDs
+            # Without this, you're likely to face freezes when the (much slower) queue is full
+            #
+            # wiki source: https://wiki.archlinux.org/title/Dm-crypt/Specialties#Disable_workqueue_for_increased_solid_state_drive_(SSD)_performance
+            # origin blog: https://blog.cloudflare.com/speeding-up-linux-disk-encryption/
+            bypassWorkqueues = true;
+
+            # Setting "true" here can also improve SSD performance, plus maybe lifetime
+            # assuming regular fstrim usage (like with the default services.fstrim)
+            # but can cause problems for plausable deniability.
+            #
+            # This is set because I believe performance should take precedence over that by default.
+            #
+            # wiki source: https://wiki.archlinux.org/title/Dm-crypt/Specialties#Discard/TRIM_support_for_solid_state_drives_(SSD)
+            # illustration/discussion: https://asalor.blogspot.com/2011/08/trim-dm-crypt-problems.html
+            allowDiscards = true;
+          }
+        );
+      }
+    );
+  };
+}