feature(disk): allow discards on cryptroot

Reviewed-on: #84

INSTALLATION.md

@@ -2,8 +2,13 @@
 
 - The installations presented in this repository are always luks encrypted
 - For simplicity I'm using device labels rather than uuids
+- Secure Boot has to be disabled in the firmware, the installer iso isn't signed
 
-1. the partitioning layout should look somewhat like this after the installation
+1. create the partitions with `cfdisk` or `fdisk` (gpt)
+   - `nvme0n1p1`: 2G, type `EFI System`, otherwise the firmware won't find the bootloader
+   - `nvme0n1p2`: the rest, type `Linux filesystem`
+
+   the layout should look somewhat like this after the installation
 ```bash
 NAME               MAJ:MIN RM   SIZE RO TYPE  MOUNTPOINTS
 nvme0n1            259:0    0 476.9G  0 disk
@@ -30,12 +35,13 @@ cryptsetup luksOpen /dev/nvme0n1p2 cryptroot
 pvcreate /dev/mapper/cryptroot
 # create a volume group inside
 vgcreate lvmroot /dev/mapper/cryptroot
-# create the swap volume
-lvcreate --size 8G lvmroot --name swap
+# create the swap volume, half the ram (no hibernation)
+lvcreate --size 16G lvmroot --name swap
 # if you desire, create a home volume
 lvcreate --size 150G lvmroot --name home
-# create the root volume
-lvcreate -l 100%FREE lvmroot --name root
+# create the root volume, leave some space in the vg to grow volumes later
+# (lvextend -r -L +50G lvmroot/home works while mounted)
+lvcreate -l 90%FREE lvmroot --name root
 
 # format as usual for root partition
 mkfs.ext4 -L "nixroot" /dev/mapper/lvmroot-root
@@ -47,7 +53,7 @@ mkswap -L "nixswap" /dev/mapper/lvmroot-swap
 # mount root
 mount /dev/disk/by-label/nixroot /mnt
 # mount boot
-mount --mkdir /dev/nvme0n1p1 /mnt/boot
+mount --mkdir /dev/disk/by-label/nixboot /mnt/boot
 # again, if you did the home volume
 mount --mkdir /dev/disk/by-label/nixhome /mnt/home
 # turn on swap
@@ -59,8 +65,7 @@ swapon /dev/disk/by-label/nixswap
 # generate templates and update the hardware-configuration.nix
 nixos-generate-config --root /mnt
 
-# add dm-crypt and dm-mod to the kernelModules
-boot.initrd.kernelModules = [ "dm-crypt" "dm-mod" ];
+# no extra kernelModules needed, luks and lvm load dm_crypt and dm_mod themselves
 
 # add file systems using labels
 fileSystems."/" =
@@ -81,7 +86,13 @@ swapDevices =
   ];
 
 # point the bootloader to the luks device
-boot.initrd.luks.devices."cryptroot".device = "/dev/disk/by-label/nixcrypt";
+boot.initrd.luks.devices."cryptroot" = {
+  device = "/dev/disk/by-label/nixcrypt";
+  # without this fstrim never reaches the ssd
+  allowDiscards = true;
+  # lower latency on nvme
+  bypassWorkqueues = true;
+};
 ```
 
 4. install nixos

hosts/argon/configuration.nix

@@ -51,6 +51,8 @@ in
   boot.initrd.luks.devices = lib.mapAttrs (name: uuid: {
     device = "/dev/disk/by-uuid/${uuid}";
     keyFile = key name;
+    # trim for ssds, ignored by drives without discard support
+    allowDiscards = true;
   }) drives;
   fileSystems = lib.mapAttrs' (
     name: _:

hosts/argon/hardware-configuration.nix

@@ -22,18 +22,21 @@
     "usb_storage"
     "sd_mod"
   ];
-  boot.initrd.kernelModules = [ "dm-crypt dm-mod" ];
-  boot.initrd.luks.devices."cryptroot".device = "/dev/disk/by-label/nixcrypt";
+  boot.initrd.luks.devices."cryptroot" = {
+    device = "/dev/disk/by-label/nixcrypt";
+    allowDiscards = true;
+    bypassWorkqueues = true;
+  };
   boot.kernelModules = [ ];
   boot.extraModulePackages = [ ];
 
   fileSystems."/" = {
-    device = "/dev/mapper/lvmroot-root";
+    device = "/dev/disk/by-label/nixroot";
     fsType = "ext4";
   };
 
   fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/AC1C-20EB";
+    device = "/dev/disk/by-label/nixboot";
     fsType = "vfat";
     options = [
       "fmask=0022"
@@ -42,12 +45,12 @@
   };
 
   fileSystems."/home" = {
-    device = "/dev/mapper/lvmroot-home";
+    device = "/dev/disk/by-label/nixhome";
     fsType = "ext4";
   };
 
   swapDevices = [
-    { device = "/dev/mapper/lvmroot-swap"; }
+    { device = "/dev/disk/by-label/nixswap"; }
   ];
 
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";

hosts/neon/hardware-configuration.nix

@@ -25,7 +25,11 @@
     "dm-snapshot"
     "cryptd"
   ];
-  boot.initrd.luks.devices."cryptroot".device = "/dev/disk/by-label/nixcrypt";
+  boot.initrd.luks.devices."cryptroot" = {
+    device = "/dev/disk/by-label/nixcrypt";
+    allowDiscards = true;
+    bypassWorkqueues = true;
+  };
 
   boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];

modules/nixos/bootloader.nix

@@ -24,6 +24,12 @@
   boot.kernelPackages = pkgs.linuxPackages_latest;
   boot.consoleLogLevel = 2;
 
+  # /tmp in RAM, nix builds go to /var/tmp instead (see settings.nix)
+  boot.tmp = {
+    useTmpfs = true;
+    tmpfsSize = "50%";
+  };
+
   # Add boot-related packages
   environment.systemPackages = with pkgs; [
     efibootmgr

modules/nixos/settings.nix

@@ -27,6 +27,9 @@
     };
   };
 
+  # build on disk, big builds would fill the /tmp tmpfs
+  systemd.services.nix-daemon.environment.TMPDIR = "/var/tmp";
+
   # steam, protonvpn, discord, etc.
   nixpkgs.config.allowUnfree = true;