5 Commits

2 changed files with 27 additions and 34 deletions

View File

@@ -4,7 +4,6 @@
- For simplicity I'm using device labels rather than uuids
1. the partitioning layout should look somewhat like this after the installation
```bash
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTS
nvme0n1 259:0 0 476.9G 0 disk
@@ -13,25 +12,26 @@ nvme0n1 259:0 0 476.9G 0 disk
└─cryptroot 254:0 0 474.9G 0 crypt
├─lvmroot-swap 254:1 0 20G 0 lvm [SWAP]
├─lvmroot-home 254:2 0 250G 0 lvm /home
└─lvmroot-root 254:3 0 204.9G 0 lvm /nix/store
```
└─lvmroot-root 254:3 0 204.9G 0 lvm /
```
> Note: `lsblk` may additionally show `/nix/store` as a mountpoint on `lvmroot-root`. This is not a separate partition. NixOS mounts the root device a second time at `/nix/store` with `ro,nosuid,nodev` flags to enforce store immutability at runtime.
2. prepare the installation
```bash
# format the boot partition
mkfs.fat -F 32 /dev/sda1 -n "nixboot"
mkfs.fat -F 32 /dev/nvme0n1p1 -n "nixboot"
# create an encrypted partition
cryptsetup luksFormat -y --label="nixcrypt" /dev/sda2
cryptsetup luksFormat -y --label="nixcrypt" /dev/nvme0n1p2
# open the encrypted partition and map it to /dev/mapper/cryptroot
cryptsetup luksOpen /dev/sda2 cryptroot
cryptsetup luksOpen /dev/nvme0n1p2 cryptroot
# create the physical volume
pvcreate /dev/mapper/cryptroot
# create a volume group inside
vgcreate lvmroot /dev/mapper/cryptroot
# create the swap volume
lvcreate --size 8G lvmroot --name nwap
lvcreate --size 8G lvmroot --name swap
# if you desire, create a home volume
lvcreate --size 150G lvmroot --name home
# create the root volume
@@ -47,7 +47,7 @@ mkswap -L "nixswap" /dev/mapper/lvmroot-swap
# mount root
mount /dev/disk/by-label/nixroot /mnt
# mount boot
mount --mkdir /dev/sda1 /mnt/boot
mount --mkdir /dev/nvme0n1p1 /mnt/boot
# again, if you did the home volume
mount --mkdir /dev/disk/by-label/nixhome /mnt/home
# turn on swap
@@ -55,13 +55,12 @@ swapon /dev/disk/by-label/nixswap
```
3. prepare nixos
```bash
# generate templates and update the hardware-configuration.nix
sudo nixos-generate-config --root /mnt
nixos-generate-config --root /mnt
# add cryptd to the kernelModules
boot.initrd.kernelModules = [ "dm-snapshot" "cryptd" ];
# add dm-crypt and dm-mod to the kernelModules
boot.initrd.kernelModules = [ "dm-crypt" "dm-mod" ];
# add file systems using labels
fileSystems."/" =
@@ -86,25 +85,20 @@ boot.initrd.luks.devices."cryptroot".device = "/dev/disk/by-label/nixcrypt";
```
4. install nixos
```bash
cd /mnt
sudo nixos-install
nixos-install
```
## how to deploy the inital config
## how to deploy the initial config
- Don't forget to install the bootloader, if you changed it since `nixos-install`
```bash
$ sudo nixos-rebuild --install-bootloader switch --flake .#host_name
```
## how to upgrade the system
```bash
$ cd /path/to/repo
$ sudo nix flake update
$ nix flake update
$ sudo nixos-rebuild switch --flake .#host_name
$ sudo nix-collect-garbage
```
@@ -114,7 +108,6 @@ $ sudo nix-collect-garbage
The tool nix-helper is installed by this configuration. It simplifies administrating nixos and adds more output to the rebuild command. It also features a diff after a successful build. The command uses the `NH_FLAKE` environment variable to be able to run from whatever directory.
Basic commands with a set `NH_FLAKE` variable are:
```bash
$ nh os switch
$ nh os build

24
flake.lock generated
View File

@@ -28,11 +28,11 @@
]
},
"locked": {
"lastModified": 1770491427,
"narHash": "sha256-8b+0vixdqGnIIcgsPhjdX7EGPdzcVQqYxF+ujjex654=",
"lastModified": 1771519029,
"narHash": "sha256-H59Qf82wv5kBXVoyXsmUKW+9J3o8FqgY4uKaLdsLdLg=",
"owner": "nix-community",
"repo": "home-manager",
"rev": "cbd8a72e5fe6af19d40e2741dc440d9227836860",
"rev": "167e0b6837115e672ec5f58e2b0ea39093abe807",
"type": "github"
},
"original": {
@@ -43,11 +43,11 @@
},
"nixpkgs": {
"locked": {
"lastModified": 1770197578,
"narHash": "sha256-AYqlWrX09+HvGs8zM6ebZ1pwUqjkfpnv8mewYwAo+iM=",
"lastModified": 1771369470,
"narHash": "sha256-0NBlEBKkN3lufyvFegY4TYv5mCNHbi5OmBDrzihbBMQ=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "00c21e4c93d963c50d4c0c89bfa84ed6e0694df2",
"rev": "0182a361324364ae3f436a63005877674cf45efb",
"type": "github"
},
"original": {
@@ -66,11 +66,11 @@
"systems": "systems"
},
"locked": {
"lastModified": 1770388595,
"narHash": "sha256-0NvpmDqFcJAtRFJE3RDZWnN7PDJBZutoDtN+Cl8a3DY=",
"lastModified": 1771135771,
"narHash": "sha256-wyvBIhDuyCRyjB3yPg77qoyxrlgQtBR1rVW3c9knV3E=",
"owner": "nix-community",
"repo": "nixvim",
"rev": "51abc532525e486176f9a7b24b17908c60017b54",
"rev": "ed0424f0b08d303a7348f52f7850ad1b2704f9ba",
"type": "github"
},
"original": {
@@ -86,11 +86,11 @@
]
},
"locked": {
"lastModified": 1770543184,
"narHash": "sha256-2FFYjurrYjCAT6bpN2Fv63G6vDuWybB91uvqBjJfcWE=",
"lastModified": 1771513929,
"narHash": "sha256-dPeHevAT1Cb2w/Wrfz/d5i6RfO8bvbGl/KrTPxU2l3w=",
"owner": "noctalia-dev",
"repo": "noctalia-shell",
"rev": "bf1a0f76bb5ca48991d51130022af6bead64d153",
"rev": "9c47ce03f200e0b8fc515d973440d5bc3e359785",
"type": "github"
},
"original": {