i'm going to tune my live ISO usb generation a bit first, then it should be

- partition the disk
- luks
- zfs datasets
- install bare minimum Nix with ssh authorized key
- borg extract persist volumes backup
- morph deploy from centralized config