erofs
system.etc.overlay requires erofs kernel module, but hardened profile from nixpkgs disables it. Patch nixpkgs and remove erofs module from blacklist.
use fork of lite-config to support patching nixpkgs for hosts