nixconfig/INSTALLATION.md

basic system installation

• The installations presented in this repository are always luks encrypted
• For simplicity I'm using device labels rather than uuids
• Secure Boot has to be disabled in the firmware, the installer iso isn't signed

1. create the partitions with cfdisk or fdisk (gpt)

   • nvme0n1p1: 2G, type EFI System, otherwise the firmware won't find the bootloader
   • nvme0n1p2: the rest, type Linux filesystem

   the layout should look somewhat like this after the installation

NAME               MAJ:MIN RM   SIZE RO TYPE  MOUNTPOINTS
nvme0n1            259:0    0 476.9G  0 disk
├─nvme0n1p1        259:1    0     2G  0 part  /boot
└─nvme0n1p2        259:2    0 474.9G  0 part
  └─cryptroot      254:0    0 474.9G  0 crypt
    ├─lvmroot-swap 254:1    0    20G  0 lvm   [SWAP]
    ├─lvmroot-home 254:2    0   250G  0 lvm   /home
    └─lvmroot-root 254:3    0 204.9G  0 lvm   /

Note: lsblk may additionally show /nix/store as a mountpoint on lvmroot-root. This is not a separate partition. NixOS mounts the root device a second time at /nix/store with ro,nosuid,nodev flags to enforce store immutability at runtime.

2. prepare the installation

# format the boot partition
mkfs.fat -F 32 /dev/nvme0n1p1 -n "nixboot"
# create an encrypted partition
cryptsetup luksFormat -y --label="nixcrypt" /dev/nvme0n1p2
# open the encrypted partition and map it to /dev/mapper/cryptroot
cryptsetup luksOpen /dev/nvme0n1p2 cryptroot

# create the physical volume
pvcreate /dev/mapper/cryptroot
# create a volume group inside
vgcreate lvmroot /dev/mapper/cryptroot
# create the swap volume, half the ram (no hibernation)
lvcreate --size 16G lvmroot --name swap
# if you desire, create a home volume
lvcreate --size 150G lvmroot --name home
# create the root volume, leave some space in the vg to grow volumes later
# (lvextend -r -L +50G lvmroot/home works while mounted)
lvcreate -l 90%FREE lvmroot --name root

# format as usual for root partition
mkfs.ext4 -L "nixroot" /dev/mapper/lvmroot-root
# if you previously made the home partition, do it too
mkfs.ext4 -L "nixhome" /dev/mapper/lvmroot-home
# format the swap partition
mkswap -L "nixswap" /dev/mapper/lvmroot-swap

# mount root
mount /dev/disk/by-label/nixroot /mnt
# mount boot
mount --mkdir /dev/disk/by-label/nixboot /mnt/boot
# again, if you did the home volume
mount --mkdir /dev/disk/by-label/nixhome /mnt/home
# turn on swap
swapon /dev/disk/by-label/nixswap

3. prepare nixos

# generate templates and update the hardware-configuration.nix
nixos-generate-config --root /mnt

# no extra kernelModules needed, luks and lvm load dm_crypt and dm_mod themselves

# add file systems using labels
fileSystems."/" =
  { device = "/dev/disk/by-label/nixroot";
    fsType = "ext4";
  };
fileSystems."/boot" =
  { device = "/dev/disk/by-label/nixboot";
    fsType = "vfat";
    options = [ "fmask=0022" "dmask=0022" ];
  };
fileSystems."/home" =
  { device = "/dev/disk/by-label/nixhome";
    fsType = "ext4";
  };
swapDevices =
  [ { device = "/dev/disk/by-label/nixswap"; }
  ];

# point the bootloader to the luks device
boot.initrd.luks.devices."cryptroot" = {
  device = "/dev/disk/by-label/nixcrypt";
  # without this fstrim never reaches the ssd
  allowDiscards = true;
  # lower latency on nvme
  bypassWorkqueues = true;
};

4. install nixos

nixos-install

how to deploy the initial config

• Don't forget to install the bootloader, if you changed it since nixos-install

$ sudo nixos-rebuild --install-bootloader switch --flake .#host_name

how to upgrade the system

$ cd /path/to/repo
$ nix flake update
$ sudo nixos-rebuild switch --flake .#host_name
$ sudo nix-collect-garbage

how to use nix-helper

The tool nix-helper is installed by this configuration. It simplifies administrating nixos and adds more output to the rebuild command. It also features a diff after a successful build. The command uses the NH_FLAKE environment variable to be able to run from whatever directory.

Basic commands with a set NH_FLAKE variable are:

$ nh os switch
$ nh os build
$ nh os test
$ nh clean all --keep 5

There is also the option to interface with home-manager by using nh home switch but this isn't necessary since home-manager is imported as a module in this config.