The resumeDevice and kernel `resume` parameter were being used wrong.
Only `boot.resumeDevice` is necessary, and it should point at the _block
device_ that holds the swapfile. If you are running on encrypted
volumes, this means you will need to use the name of the *decrypted
block device* on which the swapfile sits.
Hibernation is now a core option:
```
pub-solar.core.hibernation.enable = true;
```
And there's a paranoia mode, that keeps the disk encrypted as much as
possible by enabling hibernation and removing the options for sleep,
screen locking.
Idle locking now hibernates, and it does it on very short notice.
Benjamin Bädorf