{
  config,
  lib,
  ...
}: let
  cfg = config.os.core.bootloader;
in {
  options.os.core.bootloader = {
    type = lib.mkOption {
      type = lib.types.enum ["systemd-boot" "grub" "none"];
      default = "systemd-boot";
      description = "which bootloader to use";
    };
    useOSProber = lib.mkOption {
      type = lib.types.bool;
      default = false;
      description = "scan for other operating systems";
    };
    enableEncryption = lib.mkOption {
      type = lib.types.bool;
      default = false;
      description = "Enables LUKS encryption";
    };
    grubDevice = lib.mkOption {
      type = lib.types.str;
      default = "nodev";
    };
    luksDevice = lib.mkOption {
      type = lib.types.nullOr lib.types.str;
      default = null;
      description = "The underlying partition for LUKS";
    };
  };

  config = lib.mkMerge [
    {
      boot = {
        supportedFilesystems = ["ntfs" "btrfs"];
        kernelParams = ["quiet" "splash"];
        initrd.luks.devices = lib.mkIf (cfg.enableEncryption && cfg.luksDevice != null) {
          "crypted" = {
            device = cfg.luksDevice;
            preLVM = true;
            allowDiscards = true;
          };
        };
      };
      systemd.settings.Manager.DefaultTimeoutStopSec = "5s";
    }

    (lib.mkIf (cfg.type == "systemd-boot") {
      boot = {
        consoleLogLevel = 0;
        loader = {
          efi.canTouchEfiVariables = true;
          timeout = 0;
          systemd-boot = {
            enable = true;
            editor = false;
          };
        };
      };
    })

    (lib.mkIf (cfg.type == "grub") {
      boot.loader = {
        timeout = 3;
        efi.canTouchEfiVariables = cfg.grubDevice == "nodev";
        grub = {
          enable = true;
          device = cfg.grubDevice;
          useOSProber = cfg.useOSProber;
          enableCryptodisk = cfg.enableEncryption;

          default =
            if cfg.useOSProber
            then 2
            else 0;

          efiSupport = lib.mkDefault (cfg.grubDevice == "nodev");
          copyKernels = lib.mkIf cfg.enableEncryption true;
        };
      };
    })
  ];
}