{ config, ... }:
{
  boot.loader.systemd-boot.enable = false;
  boot.loader.efi.canTouchEfiVariables = true;

  boot.kernelParams = [ "console=ttyS0,115200n8" ];

  boot.loader.grub = {
    enable = true;
    efiSupport = true;
    devices = [ ];
    mirroredBoots = [
      {
        devices = [ "nodev" ];
        path = "/boot/a";
      }
      {
        devices = [ "nodev" ];
        path = "/boot/b";
      }
    ];
    extraConfig = "
      serial --speed=115200 --unit=0 --word=8 --parity=no --stop=1
      terminal_input serial
      terminal_output serial
    ";

  };

  age.secrets."initrd-ssh-hostkey".file = ../../agenix/${config.networking.hostName}-initrd-ssh-hostkey.age;

  boot.initrd = {
    kernelModules = [
      "ipv6"
      "8021q"
    ];
    systemd = {
      enable = true;
      network = {
        enable = true;
        netdevs = {
          "20-vlan100" = {
            netdevConfig = {
              Kind = "vlan";
              Name = "vlan100";
              Description = "LAN Access";
            };
            vlanConfig.Id = 100;
          };
        };
        networks = {
          "30-eno2" = {
            matchConfig.Name = "enp38s0";
            networkConfig.LinkLocalAddressing = "no";
            vlan = [
              "vlan100"
            ];
          };
          "40-vlan100" = {
            matchConfig.Name = "vlan100";
            networkConfig = {
              DHCP = "no";
              IPv6AcceptRA = false;
            };
            address = [
              "fd42:23:42:b864::72:2/64"
            ];
            gateway = [
              "fe80::1"
            ];
          };
        };
      };
    };
    network = {
      ssh = {
        enable = true;
        hostKeys = [
          config.age.secrets."initrd-ssh-hostkey".path
        ];
        authorizedKeys = config.users.users.root.openssh.authorizedKeys.keys;
      };
    };
  };
}

In reply to @hexa:lossy.network
the agenix secret is decrypted to a volatile location on the host after before activation