From 21e7e68ad4ad785991b59695e63faf0cd7d4c60f Mon Sep 17 00:00:00 2001
From: aaron <aaron@0x29a.ch>
Date: Sat, 3 Oct 2026 10:57:34 +0200
Subject: [PATCH] chore: remove old vm host entry since it is not used anymore

---
 INSTALLATION.md                          |  2 +-
 hosts/argon/configuration.nix            | 35 +++++-----------------
 hosts/argon/hardware-configuration.nix   |  4 +--
 hosts/krypton/hardware-configuration.nix |  4 +--
 hosts/neon/hardware-configuration.nix    |  4 +--
 modules/nixos/data-drives.nix            | 37 ++++++++++++++++++++++++
 6 files changed, 52 insertions(+), 34 deletions(-)
 create mode 100644 modules/nixos/data-drives.nix

diff --git a/INSTALLATION.md b/INSTALLATION.md
index a8f132d..56d205c 100644
--- a/INSTALLATION.md
+++ b/INSTALLATION.md
@@ -75,7 +75,7 @@ fileSystems."/" =
 fileSystems."/boot" =
   { device = "/dev/disk/by-label/nixboot";
     fsType = "vfat";
-    options = [ "fmask=0022" "dmask=0022" ];
+    options = [ "fmask=0077" "dmask=0077" ];  # only root may read /boot
   };
 fileSystems."/home" =
   { device = "/dev/disk/by-label/nixhome";
diff --git a/hosts/argon/configuration.nix b/hosts/argon/configuration.nix
index d67967b..7159fd6 100644
--- a/hosts/argon/configuration.nix
+++ b/hosts/argon/configuration.nix
@@ -1,17 +1,7 @@
 # argon: desktop with an amd gpu and three luks-encrypted data drives.
-# The drives are unlocked in the initrd with keyfiles from /etc/nixos/keys.
 
-{ lib, pkgs, ... }:
+{ pkgs, ... }:
 
-let
-  # luks name -> partition uuid, mounted at /mnt/<name>
-  drives = {
-    data1 = "dfae62cc-bad1-4879-bf9a-461bde833625";
-    data2 = "8312edae-9247-481b-a313-52a7f848f027";
-    nvmecache = "2352250e-4ebe-4f9a-bf66-0d4aaa961bd8";
-  };
-  key = name: "/etc/nixos/keys/${name}.key";
-in
 {
   imports = [
     ../../modules/nixos/appimage.nix
@@ -19,6 +9,7 @@ in
     ../../modules/nixos/audio.nix
     ../../modules/nixos/bootloader.nix
     ../../modules/nixos/certificates.nix
+    ../../modules/nixos/data-drives.nix
     ../../modules/nixos/gnupg.nix
     ../../modules/nixos/greetd.nix
     ../../modules/nixos/locales.nix
@@ -46,22 +37,12 @@ in
   };
   hardware.amdgpu.initrd.enable = true;
 
-  # encrypted data drives
-  boot.initrd.secrets = lib.mapAttrs' (name: _: lib.nameValuePair (key name) (key name)) drives;
-  boot.initrd.luks.devices = lib.mapAttrs (name: uuid: {
-    device = "/dev/disk/by-uuid/${uuid}";
-    keyFile = key name;
-    # trim for ssds, ignored by drives without discard support
-    allowDiscards = true;
-  }) drives;
-  fileSystems = lib.mapAttrs' (
-    name: _:
-    lib.nameValuePair "/mnt/${name}" {
-      device = "/dev/mapper/${name}";
-      fsType = "ext4";
-      options = [ "nofail" ];
-    }
-  ) drives;
+  # encrypted data drives, see data-drives.nix
+  local.dataDrives = {
+    data1 = "dfae62cc-bad1-4879-bf9a-461bde833625";
+    data2 = "8312edae-9247-481b-a313-52a7f848f027";
+    nvmecache = "2352250e-4ebe-4f9a-bf66-0d4aaa961bd8";
+  };
 
   environment.systemPackages = with pkgs; [
     amdgpu_top
diff --git a/hosts/argon/hardware-configuration.nix b/hosts/argon/hardware-configuration.nix
index 69686bf..4518826 100644
--- a/hosts/argon/hardware-configuration.nix
+++ b/hosts/argon/hardware-configuration.nix
@@ -39,8 +39,8 @@
     device = "/dev/disk/by-label/nixboot";
     fsType = "vfat";
     options = [
-      "fmask=0022"
-      "dmask=0022"
+      "fmask=0077"
+      "dmask=0077"
     ];
   };
 
diff --git a/hosts/krypton/hardware-configuration.nix b/hosts/krypton/hardware-configuration.nix
index 10b7825..c0cbae7 100644
--- a/hosts/krypton/hardware-configuration.nix
+++ b/hosts/krypton/hardware-configuration.nix
@@ -40,8 +40,8 @@
     device = "/dev/disk/by-label/nixboot";
     fsType = "vfat";
     options = [
-      "fmask=0022"
-      "dmask=0022"
+      "fmask=0077"
+      "dmask=0077"
     ];
   };
 
diff --git a/hosts/neon/hardware-configuration.nix b/hosts/neon/hardware-configuration.nix
index e115731..6986b76 100644
--- a/hosts/neon/hardware-configuration.nix
+++ b/hosts/neon/hardware-configuration.nix
@@ -43,8 +43,8 @@
     device = "/dev/disk/by-label/nixboot";
     fsType = "vfat";
     options = [
-      "fmask=0022"
-      "dmask=0022"
+      "fmask=0077"
+      "dmask=0077"
     ];
   };
 
diff --git a/modules/nixos/data-drives.nix b/modules/nixos/data-drives.nix
new file mode 100644
index 0000000..6b5dfd5
--- /dev/null
+++ b/modules/nixos/data-drives.nix
@@ -0,0 +1,37 @@
+# luks-encrypted data drives, unlocked after boot via /etc/crypttab with
+# keyfiles from /etc/nixos/keys/<name>.key on the encrypted root.
+# Not in boot.initrd.luks on purpose: keyfiles there end up in the initrd
+# on the unencrypted /boot.
+
+{ config, lib, ... }:
+
+let
+  drives = config.local.dataDrives;
+in
+{
+  options.local.dataDrives = lib.mkOption {
+    type = lib.types.attrsOf lib.types.str;
+    default = { };
+    example = {
+      data1 = "dfae62cc-bad1-4879-bf9a-461bde833625";
+    };
+    description = "luks name -> luks partition uuid, mounted at /mnt/<name>";
+  };
+
+  config = lib.mkIf (drives != { }) {
+    environment.etc.crypttab.text = lib.concatStrings (
+      lib.mapAttrsToList (
+        name: uuid: "${name} /dev/disk/by-uuid/${uuid} /etc/nixos/keys/${name}.key luks,discard,nofail\n"
+      ) drives
+    );
+
+    fileSystems = lib.mapAttrs' (
+      name: _:
+      lib.nameValuePair "/mnt/${name}" {
+        device = "/dev/mapper/${name}";
+        fsType = "ext4";
+        options = [ "nofail" ];
+      }
+    ) drives;
+  };
+}