diff --git a/neko/hardware-configuration.nix b/neko/hardware-configuration.nix
index 9b3fa9d..161f49f 100644
--- a/neko/hardware-configuration.nix
+++ b/neko/hardware-configuration.nix
@@ -10,11 +10,17 @@
   boot.initrd.kernelModules = [ "i915" ];
   boot.kernelModules = [ "kvm-intel" ];
 
+   # system
+  boot.initrd.luks.devices."crypt-system".device = "/dev/disk/by-id/nvme-Seagate_FireCuda_530_ZP4000GM30013_7VS01VBM-part2";
+
+  # vms
+  #boot.initrd.luks.devices."crypt-vms".device = "/dev/disk/by-id/ata-CT2000MX500SSD1_2138E5D5061F";
+
   fileSystems."/" =
-    { device = "none";
-      fsType = "tmpfs";
+    { device = "/dev/mapper/crypt-system";
+      fsType = "btrfs";
       neededForBoot = true;
-      options = [ "defaults" "size=8G" "mode=755" ];
+      options = [ "subvol=root" "noatime" "nodiratime" ];
     };
 
   fileSystems."/boot" =
@@ -24,17 +30,17 @@
     };
 
   fileSystems."/nix" =
-    { device = "/dev/disk/by-id/nvme-Seagate_FireCuda_530_ZP4000GM30013_7VS01VBM-part2";
-      fsType = "bcachefs";
+    { device = "/dev/mapper/crypt-system";
+      fsType = "btrfs";
       neededForBoot = true;
-      options = [ "noatime" "nodiratime" ];
+      options = [ "subvol=nix" "noatime" "nodiratime" ];
     };
 
   fileSystems."/data" =
-    { device = "/dev/disk/by-id/nvme-Seagate_FireCuda_530_ZP4000GM30013_7VS01VBM-part3";
-      fsType = "bcachefs";
+    { device = "/dev/mapper/crypt-system";
+      fsType = "btrfs";
       neededForBoot = true;
-      options = [ "noatime" "nodiratime" ];
+      options = [ "subvol=data" "noatime" "nodiratime" ];
     };
 
   fileSystems."/home" =
@@ -54,28 +60,28 @@
     };
 
   fileSystems."/etc/nixos" =
-    { device = "/data/nixos/neko";
+    { device = "/data/nixos/mini";
       fsType = "none";
       neededForBoot = true;
       options = [ "bind" ];
       depends = [ "/data" ];
     };
 
-  fileSystems."/home/cullmann/vms" =
-    { device = "/dev/disk/by-id/nvme-CT2000P5PSSD8_213330E4ED05";
-      fsType = "bcachefs";
-      neededForBoot = true;
-      options = [ "noatime" "nodiratime" ];
-      depends = [ "/home" ];
-    };
+#   fileSystems."/home/cullmann/vms" =
+#     { device = "/dev/mapper/crypt-vms";
+#       fsType = "btrfs";
+#       neededForBoot = true;
+#       options = [ "noatime" "nodiratime" ];
+#       depends = [ "/home" ];
+#     };
 
-  fileSystems."/home/cullmann/projects" =
-    { device = "/dev/disk/by-id/nvme-Samsung_SSD_980_PRO_2TB_S69ENF0R846614L";
-      fsType = "bcachefs";
-      neededForBoot = true;
-      options = [ "noatime" "nodiratime" ];
-      depends = [ "/home" ];
-    };
+#   fileSystems."/home/cullmann/projects" =
+#     { device = "/dev/disk/by-id/nvme-Samsung_SSD_980_PRO_2TB_S69ENF0R846614L";
+#       fsType = "bcachefs";
+#       neededForBoot = true;
+#       options = [ "noatime" "nodiratime" ];
+#       depends = [ "/home" ];
+#     };
 
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
   hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
diff --git a/neko/install.txt b/neko/install.txt
index a081621..646f1ef 100644
--- a/neko/install.txt
+++ b/neko/install.txt
@@ -1,3 +1,33 @@
+# build unstable installer
+
+{
+  description = "installation media";
+  inputs.nixos.url = "nixpkgs/nixos-unstable";
+  outputs = { self, nixos }: {
+    nixosConfigurations = {
+      exampleIso = nixos.lib.nixosSystem {
+        system = "x86_64-linux";
+        modules = [
+          "${nixos}/nixos/modules/installer/cd-dvd/installation-cd-minimal-new-kernel-no-zfs.nix"
+        ];
+      };
+    };
+  };
+}
+
+git init
+git add flake.nix
+nix --extra-experimental-features flakes --extra-experimental-features nix-command build .#nixosConfigurations.exampleIso.config.system.build.isoImage
+
+sudo dd if=result/iso/nixos-24.05.20240108.317484b-x86_64-linux.iso of=/dev/sda bs=4M conv=fsync
+
+#
+# enable ssh for root
+#
+
+sudo bash
+passwd
+
 #
 # kill old efi boot stuff
 #
@@ -14,10 +44,6 @@ efibootmgr
 # install script below
 #
 
-# fix unlocking https://nixos.wiki/wiki/Bcachefs
-nix-env -iA nixos.keyutils
-keyctl link @u @s
-
 # Defining some helper variables (these will be used in later code
 # blocks as well, so make sure to use the same terminal session or
 # redefine them later)
@@ -39,8 +65,7 @@ gdisk -l $DISK
 # create partitions
 parted $DISK -- mklabel gpt
 sgdisk -n 1:0:+1024M -c 1:"EFI System Partition" -t 1:EF00 $DISK
-sgdisk -n 2:0:+256G -c 2:"nix" -t 2:8e00 $DISK
-sgdisk -n 3:0:0 -c 3:"data" -t 3:8e00 $DISK
+sgdisk -n 2:0:0 -c 2:"Linux" -t 2:8e00 $DISK
 parted $DISK -- set 1 boot on
 
 sleep 5
@@ -51,12 +76,37 @@ cat /proc/partitions
 # boot partition
 mkfs.fat -F 32 -n EFIBOOT $DISK-part1
 
-# create encrypted bcachefs
-bcachefs format --block_size=4096 --errors=ro --metadata_checksum=xxhash --data_checksum=xxhash --compression=lz4 --wide_macs --acl --encrypted --fs_label=nix --discard -f $DISK-part2
-bcachefs format --block_size=4096 --errors=ro --metadata_checksum=xxhash --data_checksum=xxhash --compression=lz4 --wide_macs --acl --encrypted --fs_label=data --discard -f $DISK-part3
+# create the crypto containers
+cryptsetup luksFormat --sector-size 4096 --batch-mode --verify-passphrase $DISK-part2
+
+sleep 5
+
+# open them, set right options persistently
+cryptsetup luksOpen --allow-discards --perf-no_read_workqueue --perf-no_write_workqueue --persistent $DISK-part2 crypt-system
+
+sleep 5
+lsblk --fs
+
+# create btrfs with fast & strong checksumming and fast mounting
+mkfs.btrfs -f --csum xxhash --features block-group-tree /dev/mapper/crypt-system
+
+sleep 5
+btrfs filesystem show
+
+# create all the volumes
+mount /dev/mapper/crypt-system /mnt
+btrfs subvolume create /mnt/data
+btrfs subvolume create /mnt/nix
+btrfs subvolume create /mnt/root
+
+sleep 5
+btrfs subvolume list /mnt
+
+# umount again, we will only use explicit subvolumes
+umount /mnt
 
 # prepare install
-mount -t tmpfs none /mnt
+mount -o subvol=root,noatime,nodiratime /dev/mapper/crypt-system /mnt
 
 # Create directories to mount file systems on
 mkdir -p /mnt/{data,nix,home,boot,root,etc/nixos}
@@ -64,9 +114,9 @@ mkdir -p /mnt/{data,nix,home,boot,root,etc/nixos}
 # mount the ESP
 mount $DISK-part1 /mnt/boot
 
-# mount bcachefs stuff
-mount -o noatime,nodiratime $DISK-part2 /mnt/nix
-mount -o noatime,nodiratime $DISK-part3 /mnt/data
+# mount volumes
+mount -o subvol=data,noatime,nodiratime /dev/mapper/crypt-system /mnt/data
+mount -o subvol=nix,noatime,nodiratime /dev/mapper/crypt-system /mnt/nix
 
 # bind mount persistent stuff to data
 mkdir -p /mnt/{data/home,data/root,data/nixos/$HOST}
@@ -74,6 +124,10 @@ mount --bind /mnt/data/home /mnt/home
 mount --bind /mnt/data/root /mnt/root
 mount --bind /mnt/data/nixos/$HOST /mnt/etc/nixos
 
+# create fake /data to have the right paths
+mkdir -p /data
+mount --bind /mnt/data /data
+
 # take a look
 mount
 
@@ -87,17 +141,16 @@ cp /mnt/etc/nixos/configuration.nix /tmp
 
 # copy config data
 
-# patch some paths there
-
 sudo scp -r /data/nixos root@192.168.13.171:/mnt/data
 
 # install
 
-nixos-install --no-root-passwd --root /mnt
+nixos-install --option experimental-features 'nix-command flakes' --no-root-passwd --root /mnt
 
 # unmount all stuff
 
-umount -Rl /mnt
+umount -Rl /data /mnt
+cryptsetup luksClose crypt-system
 
 # sync all /data after the install
 
@@ -120,8 +173,22 @@ wipefs -a $DD
 
 sleep 5
 
-# create encrypted bcachefs
-bcachefs format --block_size=4096 --errors=ro --metadata_checksum=xxhash --data_checksum=xxhash --compression=lz4 --wide_macs --acl --encrypted --fs_label=vms --discard -f $DD
+# create the crypto containers
+cryptsetup luksFormat --batch-mode --verify-passphrase $DD
+
+sleep 5
+
+# open them, set right options persistently
+cryptsetup luksOpen --allow-discards --perf-no_read_workqueue --perf-no_write_workqueue --persistent $DD crypt-vms
+
+sleep 5
+lsblk --fs
+
+# create btrfs with fast & strong checksumming and fast mounting
+mkfs.btrfs -f --csum xxhash --features block-group-tree /dev/mapper/crypt-vms
+
+sleep 5
+btrfs filesystem show
 
 # create projects disk
 
@@ -132,5 +199,19 @@ wipefs -a $DD
 
 sleep 5
 
-# create encrypted bcachefs
-bcachefs format --block_size=4096 --errors=ro --metadata_checksum=xxhash --data_checksum=xxhash --compression=lz4 --wide_macs --acl --encrypted --fs_label=projects --discard -f $DD
+# create the crypto containers
+cryptsetup luksFormat --batch-mode --verify-passphrase $DD
+
+sleep 5
+
+# open them, set right options persistently
+cryptsetup luksOpen --allow-discards --perf-no_read_workqueue --perf-no_write_workqueue --persistent $DD crypt-projects
+
+sleep 5
+lsblk --fs
+
+# create btrfs with fast & strong checksumming and fast mounting
+mkfs.btrfs -f --csum xxhash --features block-group-tree /dev/mapper/crypt-projects
+
+sleep 5
+btrfs filesystem show