diff options
Diffstat (limited to 'neko')
| -rw-r--r-- | neko/hardware-configuration.nix | 54 | ||||
| -rw-r--r-- | neko/install.txt | 123 |
2 files changed, 132 insertions, 45 deletions
diff --git a/neko/hardware-configuration.nix b/neko/hardware-configuration.nix index 9b3fa9d..161f49f 100644 --- a/neko/hardware-configuration.nix +++ b/neko/hardware-configuration.nix @@ -10,11 +10,17 @@ boot.initrd.kernelModules = [ "i915" ]; boot.kernelModules = [ "kvm-intel" ]; + # system + boot.initrd.luks.devices."crypt-system".device = "/dev/disk/by-id/nvme-Seagate_FireCuda_530_ZP4000GM30013_7VS01VBM-part2"; + + # vms + #boot.initrd.luks.devices."crypt-vms".device = "/dev/disk/by-id/ata-CT2000MX500SSD1_2138E5D5061F"; + fileSystems."/" = - { device = "none"; - fsType = "tmpfs"; + { device = "/dev/mapper/crypt-system"; + fsType = "btrfs"; neededForBoot = true; - options = [ "defaults" "size=8G" "mode=755" ]; + options = [ "subvol=root" "noatime" "nodiratime" ]; }; fileSystems."/boot" = @@ -24,17 +30,17 @@ }; fileSystems."/nix" = - { device = "/dev/disk/by-id/nvme-Seagate_FireCuda_530_ZP4000GM30013_7VS01VBM-part2"; - fsType = "bcachefs"; + { device = "/dev/mapper/crypt-system"; + fsType = "btrfs"; neededForBoot = true; - options = [ "noatime" "nodiratime" ]; + options = [ "subvol=nix" "noatime" "nodiratime" ]; }; fileSystems."/data" = - { device = "/dev/disk/by-id/nvme-Seagate_FireCuda_530_ZP4000GM30013_7VS01VBM-part3"; - fsType = "bcachefs"; + { device = "/dev/mapper/crypt-system"; + fsType = "btrfs"; neededForBoot = true; - options = [ "noatime" "nodiratime" ]; + options = [ "subvol=data" "noatime" "nodiratime" ]; }; fileSystems."/home" = @@ -54,28 +60,28 @@ }; fileSystems."/etc/nixos" = - { device = "/data/nixos/neko"; + { device = "/data/nixos/mini"; fsType = "none"; neededForBoot = true; options = [ "bind" ]; depends = [ "/data" ]; }; - fileSystems."/home/cullmann/vms" = - { device = "/dev/disk/by-id/nvme-CT2000P5PSSD8_213330E4ED05"; - fsType = "bcachefs"; - neededForBoot = true; - options = [ "noatime" "nodiratime" ]; - depends = [ "/home" ]; - }; +# fileSystems."/home/cullmann/vms" = +# { device = "/dev/mapper/crypt-vms"; +# fsType = "btrfs"; +# neededForBoot = true; +# options = [ "noatime" "nodiratime" ]; +# depends = [ "/home" ]; +# }; - fileSystems."/home/cullmann/projects" = - { device = "/dev/disk/by-id/nvme-Samsung_SSD_980_PRO_2TB_S69ENF0R846614L"; - fsType = "bcachefs"; - neededForBoot = true; - options = [ "noatime" "nodiratime" ]; - depends = [ "/home" ]; - }; +# fileSystems."/home/cullmann/projects" = +# { device = "/dev/disk/by-id/nvme-Samsung_SSD_980_PRO_2TB_S69ENF0R846614L"; +# fsType = "bcachefs"; +# neededForBoot = true; +# options = [ "noatime" "nodiratime" ]; +# depends = [ "/home" ]; +# }; nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; diff --git a/neko/install.txt b/neko/install.txt index a081621..646f1ef 100644 --- a/neko/install.txt +++ b/neko/install.txt @@ -1,3 +1,33 @@ +# build unstable installer + +{ + description = "installation media"; + inputs.nixos.url = "nixpkgs/nixos-unstable"; + outputs = { self, nixos }: { + nixosConfigurations = { + exampleIso = nixos.lib.nixosSystem { + system = "x86_64-linux"; + modules = [ + "${nixos}/nixos/modules/installer/cd-dvd/installation-cd-minimal-new-kernel-no-zfs.nix" + ]; + }; + }; + }; +} + +git init +git add flake.nix +nix --extra-experimental-features flakes --extra-experimental-features nix-command build .#nixosConfigurations.exampleIso.config.system.build.isoImage + +sudo dd if=result/iso/nixos-24.05.20240108.317484b-x86_64-linux.iso of=/dev/sda bs=4M conv=fsync + +# +# enable ssh for root +# + +sudo bash +passwd + # # kill old efi boot stuff # @@ -14,10 +44,6 @@ efibootmgr # install script below # -# fix unlocking https://nixos.wiki/wiki/Bcachefs -nix-env -iA nixos.keyutils -keyctl link @u @s - # Defining some helper variables (these will be used in later code # blocks as well, so make sure to use the same terminal session or # redefine them later) @@ -39,8 +65,7 @@ gdisk -l $DISK # create partitions parted $DISK -- mklabel gpt sgdisk -n 1:0:+1024M -c 1:"EFI System Partition" -t 1:EF00 $DISK -sgdisk -n 2:0:+256G -c 2:"nix" -t 2:8e00 $DISK -sgdisk -n 3:0:0 -c 3:"data" -t 3:8e00 $DISK +sgdisk -n 2:0:0 -c 2:"Linux" -t 2:8e00 $DISK parted $DISK -- set 1 boot on sleep 5 @@ -51,12 +76,37 @@ cat /proc/partitions # boot partition mkfs.fat -F 32 -n EFIBOOT $DISK-part1 -# create encrypted bcachefs -bcachefs format --block_size=4096 --errors=ro --metadata_checksum=xxhash --data_checksum=xxhash --compression=lz4 --wide_macs --acl --encrypted --fs_label=nix --discard -f $DISK-part2 -bcachefs format --block_size=4096 --errors=ro --metadata_checksum=xxhash --data_checksum=xxhash --compression=lz4 --wide_macs --acl --encrypted --fs_label=data --discard -f $DISK-part3 +# create the crypto containers +cryptsetup luksFormat --sector-size 4096 --batch-mode --verify-passphrase $DISK-part2 + +sleep 5 + +# open them, set right options persistently +cryptsetup luksOpen --allow-discards --perf-no_read_workqueue --perf-no_write_workqueue --persistent $DISK-part2 crypt-system + +sleep 5 +lsblk --fs + +# create btrfs with fast & strong checksumming and fast mounting +mkfs.btrfs -f --csum xxhash --features block-group-tree /dev/mapper/crypt-system + +sleep 5 +btrfs filesystem show + +# create all the volumes +mount /dev/mapper/crypt-system /mnt +btrfs subvolume create /mnt/data +btrfs subvolume create /mnt/nix +btrfs subvolume create /mnt/root + +sleep 5 +btrfs subvolume list /mnt + +# umount again, we will only use explicit subvolumes +umount /mnt # prepare install -mount -t tmpfs none /mnt +mount -o subvol=root,noatime,nodiratime /dev/mapper/crypt-system /mnt # Create directories to mount file systems on mkdir -p /mnt/{data,nix,home,boot,root,etc/nixos} @@ -64,9 +114,9 @@ mkdir -p /mnt/{data,nix,home,boot,root,etc/nixos} # mount the ESP mount $DISK-part1 /mnt/boot -# mount bcachefs stuff -mount -o noatime,nodiratime $DISK-part2 /mnt/nix -mount -o noatime,nodiratime $DISK-part3 /mnt/data +# mount volumes +mount -o subvol=data,noatime,nodiratime /dev/mapper/crypt-system /mnt/data +mount -o subvol=nix,noatime,nodiratime /dev/mapper/crypt-system /mnt/nix # bind mount persistent stuff to data mkdir -p /mnt/{data/home,data/root,data/nixos/$HOST} @@ -74,6 +124,10 @@ mount --bind /mnt/data/home /mnt/home mount --bind /mnt/data/root /mnt/root mount --bind /mnt/data/nixos/$HOST /mnt/etc/nixos +# create fake /data to have the right paths +mkdir -p /data +mount --bind /mnt/data /data + # take a look mount @@ -87,17 +141,16 @@ cp /mnt/etc/nixos/configuration.nix /tmp # copy config data -# patch some paths there - sudo scp -r /data/nixos root@192.168.13.171:/mnt/data # install -nixos-install --no-root-passwd --root /mnt +nixos-install --option experimental-features 'nix-command flakes' --no-root-passwd --root /mnt # unmount all stuff -umount -Rl /mnt +umount -Rl /data /mnt +cryptsetup luksClose crypt-system # sync all /data after the install @@ -120,8 +173,22 @@ wipefs -a $DD sleep 5 -# create encrypted bcachefs -bcachefs format --block_size=4096 --errors=ro --metadata_checksum=xxhash --data_checksum=xxhash --compression=lz4 --wide_macs --acl --encrypted --fs_label=vms --discard -f $DD +# create the crypto containers +cryptsetup luksFormat --batch-mode --verify-passphrase $DD + +sleep 5 + +# open them, set right options persistently +cryptsetup luksOpen --allow-discards --perf-no_read_workqueue --perf-no_write_workqueue --persistent $DD crypt-vms + +sleep 5 +lsblk --fs + +# create btrfs with fast & strong checksumming and fast mounting +mkfs.btrfs -f --csum xxhash --features block-group-tree /dev/mapper/crypt-vms + +sleep 5 +btrfs filesystem show # create projects disk @@ -132,5 +199,19 @@ wipefs -a $DD sleep 5 -# create encrypted bcachefs -bcachefs format --block_size=4096 --errors=ro --metadata_checksum=xxhash --data_checksum=xxhash --compression=lz4 --wide_macs --acl --encrypted --fs_label=projects --discard -f $DD +# create the crypto containers +cryptsetup luksFormat --batch-mode --verify-passphrase $DD + +sleep 5 + +# open them, set right options persistently +cryptsetup luksOpen --allow-discards --perf-no_read_workqueue --perf-no_write_workqueue --persistent $DD crypt-projects + +sleep 5 +lsblk --fs + +# create btrfs with fast & strong checksumming and fast mounting +mkfs.btrfs -f --csum xxhash --features block-group-tree /dev/mapper/crypt-projects + +sleep 5 +btrfs filesystem show |