Дополнительный зашифрованный swap на 4 гига - для старых телефонов свопов много не бывает. Работать будет вместо с zram0:

#!/bin/bash
set -e

SWAP_SIZE="4G" # Reduced for eMMC longevity

echo "[*] Creating ${SWAP_SIZE} swap file..."

# Use dd instead of fallocate for better compatibility with encrypted filesystems
# fallocate may create holes that don't work well with encryption
dd if=/dev/zero of=/swapfile bs=1M count=4096 status=progress
chmod 600 /swapfile

echo "[*] Creating encrypted swap script..."

cat > /usr/local/bin/encrypted-swap.sh <<'SCRIPT'
#!/bin/bash
set -e

# Ждём, пока zram будет создан
for i in {1..30}; do
if [ -b /dev/zram0 ]; then
break
fi
sleep 1
done

# Отключаем существующие swap
swapoff /dev/zram0 2>/dev/null || true
swapoff /dev/mapper/swapfile 2>/dev/null || true
cryptsetup close swapfile 2>/dev/null || true
losetup -D 2>/dev/null || true
rm -f /run/encrypted-swap.loop

# Настраиваем loop для swapfile
LOOPDEV=$(losetup -f --show /swapfile)
echo "$LOOPDEV" > /run/encrypted-swap.loop

# Открываем с шифрованием
cryptsetup open --type plain \
--key-file /dev/urandom \
--cipher aes-xts-plain64 \
--key-size 256 \
"$LOOPDEV" swapfile

mkswap -f /dev/mapper/swapfile

# Активируем ОБА swap с ОДИНАКОВЫМ приоритетом
swapon -p 50 /dev/zram0
swapon -p 50 /dev/mapper/swapfile
SCRIPT

chmod +x /usr/local/bin/encrypted-swap.sh

echo "[*] Creating systemd service..."

cat > /etc/systemd/system/encrypted-swap.service <<'SERVICE'
[Unit]
Description=Encrypted Swap
After=local-fs.target
# Start after zram so we can set lower priority
After=zramswap.service
Wants=zramswap.service

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/usr/local/bin/encrypted-swap.sh
ExecStop=/bin/bash -c 'swapoff /dev/mapper/swapfile 2>/dev/null; cryptsetup close swapfile 2>/dev/null; LOOPDEV=$(cat /run/encrypted-swap.loop 2>/dev/null) && losetup -d $LOOPDEV 2>/dev/null || true; rm -f /run/encrypted-swap.loop'

[Install]
WantedBy=multi-user.target
SERVICE

echo "[*] Cleaning up crypttab and fstab..."
sed -i '/swap/d' /etc/crypttab 2>/dev/null || true
sed -i '/swap/d' /etc/fstab 2>/dev/null || true

echo "[*] Configuring swap preferences..."

# Moderate swappiness - let kernel decide, but prefer zram
cat > /etc/sysctl.d/99-swap.conf <<'EOF'
# Prefer zram over disk swap
vm.swappiness=100
vm.vfs_cache_pressure=200
EOF

echo "[*] Enabling encrypted swap service..."
systemctl daemon-reload
systemctl enable encrypted-swap.service

echo "[*] Activating encrypted swap..."
/usr/local/bin/encrypted-swap.sh

echo ""
echo "[*] Verification:"
swapon --show
cryptsetup status swapfile 2>/dev/null || echo "cryptsetup status failed, checking lsblk:"
lsblk | grep -i swap || true
free -h | grep -i swap

echo ""
echo "[*] Encrypted swap setup complete."
echo "[*] New random key generated at each boot."
echo "[*] Swap data is unrecoverable after shutdown."
echo "[*] WARNING: Disk swap on eMMC wears storage. Consider larger zram instead."