move grub and full-disk-encryption into seperate files

modules/grub.nix

@@ -0,0 +1,13 @@
+{
+  boot.loader.efi.canTouchEfiVariables = true;
+  boot.loader.efi.efiSysMountPoint = "/boot/efi";
+
+  boot.loader.systemd-boot.enable = false;
+  boot.loader.grub = {
+    enable = true;
+    version = 2;
+    device = "nodev";
+    efiSupport = true;
+    configurationLimit = 5;
+  };
+}

modules/luks.nix

@@ -0,0 +1,15 @@
+let
+  secretsFile = "/root.key";
+in
+{
+  boot.loader.grub.enableCryptodisk = true;
+
+  # enable passing of keyfile between grub and initrd
+  boot.initrd.luks.devices."cryptroot" = {
+    fallbackToPassword = true;
+    keyFile = secretsFile;
+  };
+
+  # copy the secret into the additional initramfs. `null` means same path
+  boot.initrd.secrets."${secretsFile}" = null;
+}