feature(boot): restrict access for /boot to root only

Reviewed-on: #86

INSTALLATION.md

@@ -2,8 +2,13 @@
 
 - The installations presented in this repository are always luks encrypted
 - For simplicity I'm using device labels rather than uuids
+- Secure Boot has to be disabled in the firmware, the installer iso isn't signed
 
-1. the partitioning layout should look somewhat like this after the installation
+1. create the partitions with `cfdisk` or `fdisk` (gpt)
+   - `nvme0n1p1`: 2G, type `EFI System`, otherwise the firmware won't find the bootloader
+   - `nvme0n1p2`: the rest, type `Linux filesystem`
+
+   the layout should look somewhat like this after the installation
 ```bash
 NAME               MAJ:MIN RM   SIZE RO TYPE  MOUNTPOINTS
 nvme0n1            259:0    0 476.9G  0 disk
@@ -30,12 +35,13 @@ cryptsetup luksOpen /dev/nvme0n1p2 cryptroot
 pvcreate /dev/mapper/cryptroot
 # create a volume group inside
 vgcreate lvmroot /dev/mapper/cryptroot
-# create the swap volume
-lvcreate --size 8G lvmroot --name swap
+# create the swap volume, half the ram (no hibernation)
+lvcreate --size 16G lvmroot --name swap
 # if you desire, create a home volume
 lvcreate --size 150G lvmroot --name home
-# create the root volume
-lvcreate -l 100%FREE lvmroot --name root
+# create the root volume, leave some space in the vg to grow volumes later
+# (lvextend -r -L +50G lvmroot/home works while mounted)
+lvcreate -l 90%FREE lvmroot --name root
 
 # format as usual for root partition
 mkfs.ext4 -L "nixroot" /dev/mapper/lvmroot-root
@@ -47,7 +53,7 @@ mkswap -L "nixswap" /dev/mapper/lvmroot-swap
 # mount root
 mount /dev/disk/by-label/nixroot /mnt
 # mount boot
-mount --mkdir /dev/nvme0n1p1 /mnt/boot
+mount --mkdir /dev/disk/by-label/nixboot /mnt/boot
 # again, if you did the home volume
 mount --mkdir /dev/disk/by-label/nixhome /mnt/home
 # turn on swap
@@ -59,8 +65,7 @@ swapon /dev/disk/by-label/nixswap
 # generate templates and update the hardware-configuration.nix
 nixos-generate-config --root /mnt
 
-# add dm-crypt and dm-mod to the kernelModules
-boot.initrd.kernelModules = [ "dm-crypt" "dm-mod" ];
+# no extra kernelModules needed, luks and lvm load dm_crypt and dm_mod themselves
 
 # add file systems using labels
 fileSystems."/" =
@@ -70,7 +75,7 @@ fileSystems."/" =
 fileSystems."/boot" =
   { device = "/dev/disk/by-label/nixboot";
     fsType = "vfat";
-    options = [ "fmask=0022" "dmask=0022" ];
+    options = [ "fmask=0077" "dmask=0077" ];  # only root may read /boot
   };
 fileSystems."/home" =
   { device = "/dev/disk/by-label/nixhome";
@@ -81,7 +86,13 @@ swapDevices =
   ];
 
 # point the bootloader to the luks device
-boot.initrd.luks.devices."cryptroot".device = "/dev/disk/by-label/nixcrypt";
+boot.initrd.luks.devices."cryptroot" = {
+  device = "/dev/disk/by-label/nixcrypt";
+  # without this fstrim never reaches the ssd
+  allowDiscards = true;
+  # lower latency on nvme
+  bypassWorkqueues = true;
+};
 ```
 
 4. install nixos

flake.lock

@@ -41,6 +41,26 @@
         "type": "github"
       }
     },
+    "nixos-hardware": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1790948122,
+        "narHash": "sha256-fDMYyzY1lI5b8RuCMrvoaIgTeRwNnTG4dNk1ucROlQE=",
+        "owner": "NixOS",
+        "repo": "nixos-hardware",
+        "rev": "0953bb1a609df63013176e3463393f8df993d3ef",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "nixos-hardware",
+        "type": "github"
+      }
+    },
     "nixpkgs": {
       "locked": {
         "lastModified": 1790689126,
@@ -102,6 +122,7 @@
     "root": {
       "inputs": {
         "home-manager": "home-manager",
+        "nixos-hardware": "nixos-hardware",
         "nixpkgs": "nixpkgs",
         "nixvim": "nixvim",
         "noctalia": "noctalia"

flake.nix

@@ -11,6 +11,10 @@
       url = "github:noctalia-dev/noctalia-shell";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    nixos-hardware = {
+      url = "github:NixOS/nixos-hardware";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
     nixvim = {
       url = "github:nix-community/nixvim";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -52,6 +56,7 @@
         default = mkHost "default";
         neon = mkHost "neon";
         argon = mkHost "argon";
+        krypton = mkHost "krypton";
       };
     };
 }

hosts/argon/configuration.nix

@@ -1,17 +1,7 @@
 # argon: desktop with an amd gpu and three luks-encrypted data drives.
-# The drives are unlocked in the initrd with keyfiles from /etc/nixos/keys.
 
-{ lib, pkgs, ... }:
+{ pkgs, ... }:
 
-let
-  # luks name -> partition uuid, mounted at /mnt/<name>
-  drives = {
-    data1 = "dfae62cc-bad1-4879-bf9a-461bde833625";
-    data2 = "8312edae-9247-481b-a313-52a7f848f027";
-    nvmecache = "2352250e-4ebe-4f9a-bf66-0d4aaa961bd8";
-  };
-  key = name: "/etc/nixos/keys/${name}.key";
-in
 {
   imports = [
     ../../modules/nixos/appimage.nix
@@ -19,6 +9,7 @@ in
     ../../modules/nixos/audio.nix
     ../../modules/nixos/bootloader.nix
     ../../modules/nixos/certificates.nix
+    ../../modules/nixos/data-drives.nix
     ../../modules/nixos/gnupg.nix
     ../../modules/nixos/greetd.nix
     ../../modules/nixos/locales.nix
@@ -46,20 +37,12 @@ in
   };
   hardware.amdgpu.initrd.enable = true;
 
-  # encrypted data drives
-  boot.initrd.secrets = lib.mapAttrs' (name: _: lib.nameValuePair (key name) (key name)) drives;
-  boot.initrd.luks.devices = lib.mapAttrs (name: uuid: {
-    device = "/dev/disk/by-uuid/${uuid}";
-    keyFile = key name;
-  }) drives;
-  fileSystems = lib.mapAttrs' (
-    name: _:
-    lib.nameValuePair "/mnt/${name}" {
-      device = "/dev/mapper/${name}";
-      fsType = "ext4";
-      options = [ "nofail" ];
-    }
-  ) drives;
+  # encrypted data drives, see data-drives.nix
+  local.dataDrives = {
+    data1 = "dfae62cc-bad1-4879-bf9a-461bde833625";
+    data2 = "8312edae-9247-481b-a313-52a7f848f027";
+    nvmecache = "2352250e-4ebe-4f9a-bf66-0d4aaa961bd8";
+  };
 
   environment.systemPackages = with pkgs; [
     amdgpu_top

hosts/argon/hardware-configuration.nix

@@ -22,32 +22,35 @@
     "usb_storage"
     "sd_mod"
   ];
-  boot.initrd.kernelModules = [ "dm-crypt dm-mod" ];
-  boot.initrd.luks.devices."cryptroot".device = "/dev/disk/by-label/nixcrypt";
+  boot.initrd.luks.devices."cryptroot" = {
+    device = "/dev/disk/by-label/nixcrypt";
+    allowDiscards = true;
+    bypassWorkqueues = true;
+  };
   boot.kernelModules = [ ];
   boot.extraModulePackages = [ ];
 
   fileSystems."/" = {
-    device = "/dev/mapper/lvmroot-root";
+    device = "/dev/disk/by-label/nixroot";
     fsType = "ext4";
   };
 
   fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/AC1C-20EB";
+    device = "/dev/disk/by-label/nixboot";
     fsType = "vfat";
     options = [
-      "fmask=0022"
-      "dmask=0022"
+      "fmask=0077"
+      "dmask=0077"
     ];
   };
 
   fileSystems."/home" = {
-    device = "/dev/mapper/lvmroot-home";
+    device = "/dev/disk/by-label/nixhome";
     fsType = "ext4";
   };
 
   swapDevices = [
-    { device = "/dev/mapper/lvmroot-swap"; }
+    { device = "/dev/disk/by-label/nixswap"; }
   ];
 
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";

hosts/default/hardware-configuration.nix

@@ -40,8 +40,8 @@
     device = "/dev/disk/by-label/nixboot";
     fsType = "vfat";
     options = [
-      "fmask=0022"
-      "dmask=0022"
+      "fmask=0077"
+      "dmask=0077"
     ];
   };
   fileSystems."/home" = {

hosts/krypton/configuration.nix

@@ -0,0 +1,35 @@
+# krypton: framework 13 pro, intel core ultra x7 358H
+
+{ inputs, ... }:
+
+{
+  imports = [
+    inputs.nixos-hardware.nixosModules.framework-intel-core-ultra-series3
+    ../../modules/nixos/appimage.nix
+    ../../modules/nixos/astro.nix
+    ../../modules/nixos/audio.nix
+    ../../modules/nixos/bootloader.nix
+    ../../modules/nixos/certificates.nix
+    ../../modules/nixos/docker.nix
+    ../../modules/nixos/gnupg.nix
+    ../../modules/nixos/locales.nix
+    ../../modules/nixos/networking.nix
+    ../../modules/nixos/niri.nix
+    ../../modules/nixos/noctalia.nix
+    ../../modules/nixos/openssh.nix
+    ../../modules/nixos/packages.nix
+    ../../modules/nixos/protonvpn.nix
+    ../../modules/nixos/sddm.nix
+    ../../modules/nixos/services.nix
+    ../../modules/nixos/settings.nix
+    ../../modules/nixos/steam.nix
+    ../../modules/nixos/users.nix
+    ../../modules/nixos/vial.nix
+  ];
+
+  # host-specific niri config (input devices, laptop binds)
+  home-manager.users.aaron.imports = [ ./niri.nix ];
+
+  networking.hostName = "krypton";
+  system.stateVersion = "26.05"; # don't change
+}

hosts/krypton/hardware-configuration.nix

@@ -0,0 +1,60 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "thunderbolt"
+    "nvme"
+    "usb_storage"
+    "sd_mod"
+  ];
+  boot.initrd.kernelModules = [ "dm-snapshot" ];
+  boot.initrd.luks.devices."cryptroot" = {
+    device = "/dev/disk/by-label/nixcrypt";
+    allowDiscards = true;
+    bypassWorkqueues = true;
+  };
+
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-label/nixroot";
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-label/nixboot";
+    fsType = "vfat";
+    options = [
+      "fmask=0077"
+      "dmask=0077"
+    ];
+  };
+
+  fileSystems."/home" = {
+    device = "/dev/disk/by-label/nixhome";
+    fsType = "ext4";
+  };
+
+  swapDevices = [
+    { device = "/dev/disk/by-label/nixswap"; }
+  ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+  hardware.cpu.intel.npu.enable = true;
+}

hosts/krypton/niri.nix

@@ -0,0 +1,24 @@
+# krypton: framework 13 laptop, the built-in display is auto-configured by niri
+
+{ lib, ... }:
+
+{
+  wayland.windowManager.niri.settings = {
+    input.touchpad = {
+      tap = { };
+      natural-scroll = { };
+    };
+
+    layout.gaps = lib.mkForce 10;
+
+    binds = {
+      "Print".screenshot = { };
+      "Ctrl+Print".screenshot-screen = { };
+      "Mod+Shift+P".power-off-monitors = { };
+
+      # finer brightness steps
+      "XF86MonBrightnessUp".spawn-sh = lib.mkForce "brightnessctl --class=backlight set +1%";
+      "XF86MonBrightnessDown".spawn-sh = lib.mkForce "brightnessctl --class=backlight set 1%-";
+    };
+  };
+}

hosts/neon/configuration.nix

@@ -1,5 +1,15 @@
+# neon: thinkpad t14 gen1 (intel)
+
+{
+  inputs,
+  lib,
+  pkgs,
+  ...
+}:
+
 {
   imports = [
+    inputs.nixos-hardware.nixosModules.lenovo-thinkpad-t14-intel-gen1
     ../../modules/nixos/appimage.nix
     ../../modules/nixos/astro.nix
     ../../modules/nixos/audio.nix
@@ -25,6 +35,16 @@
   # host-specific niri config (input devices, laptop binds)
   home-manager.users.aaron.imports = [ ./niri.nix ];
 
+  # nixos-hardware's intel module adds intel-compute-runtime-legacy1 (opencl),
+  # which isn't cached and currently fails to build; not needed on neon
+  hardware.graphics.extraPackages = lib.mkForce (
+    with pkgs;
+    [
+      intel-media-driver
+      vpl-gpu-rt
+    ]
+  );
+
   networking.hostName = "neon";
   system.stateVersion = "25.11"; # don't change
 }

hosts/neon/hardware-configuration.nix

@@ -25,7 +25,11 @@
     "dm-snapshot"
     "cryptd"
   ];
-  boot.initrd.luks.devices."cryptroot".device = "/dev/disk/by-label/nixcrypt";
+  boot.initrd.luks.devices."cryptroot" = {
+    device = "/dev/disk/by-label/nixcrypt";
+    allowDiscards = true;
+    bypassWorkqueues = true;
+  };
 
   boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];
@@ -39,8 +43,8 @@
     device = "/dev/disk/by-label/nixboot";
     fsType = "vfat";
     options = [
-      "fmask=0022"
-      "dmask=0022"
+      "fmask=0077"
+      "dmask=0077"
     ];
   };
 

modules/nixos/bootloader.nix

@@ -24,6 +24,12 @@
   boot.kernelPackages = pkgs.linuxPackages_latest;
   boot.consoleLogLevel = 2;
 
+  # /tmp in RAM, nix builds go to /var/tmp instead (see settings.nix)
+  boot.tmp = {
+    useTmpfs = true;
+    tmpfsSize = "50%";
+  };
+
   # Add boot-related packages
   environment.systemPackages = with pkgs; [
     efibootmgr

modules/nixos/data-drives.nix

@@ -0,0 +1,37 @@
+# luks-encrypted data drives, unlocked after boot via /etc/crypttab with
+# keyfiles from /etc/nixos/keys/<name>.key on the encrypted root.
+# Not in boot.initrd.luks on purpose: keyfiles there end up in the initrd
+# on the unencrypted /boot.
+
+{ config, lib, ... }:
+
+let
+  drives = config.local.dataDrives;
+in
+{
+  options.local.dataDrives = lib.mkOption {
+    type = lib.types.attrsOf lib.types.str;
+    default = { };
+    example = {
+      data1 = "dfae62cc-bad1-4879-bf9a-461bde833625";
+    };
+    description = "luks name -> luks partition uuid, mounted at /mnt/<name>";
+  };
+
+  config = lib.mkIf (drives != { }) {
+    environment.etc.crypttab.text = lib.concatStrings (
+      lib.mapAttrsToList (
+        name: uuid: "${name} /dev/disk/by-uuid/${uuid} /etc/nixos/keys/${name}.key luks,discard,nofail\n"
+      ) drives
+    );
+
+    fileSystems = lib.mapAttrs' (
+      name: _:
+      lib.nameValuePair "/mnt/${name}" {
+        device = "/dev/mapper/${name}";
+        fsType = "ext4";
+        options = [ "nofail" ];
+      }
+    ) drives;
+  };
+}

modules/nixos/settings.nix

@@ -27,6 +27,9 @@
     };
   };
 
+  # build on disk, big builds would fill the /tmp tmpfs
+  systemd.services.nix-daemon.environment.TMPDIR = "/var/tmp";
+
   # steam, protonvpn, discord, etc.
   nixpkgs.config.allowUnfree = true;