1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
|
# Defining some helper variables (these will be used in later code
# blocks as well, so make sure to use the same terminal session or
# redefine them later)
DISK=/dev/disk/by-id/nvme-CT4000P3PSSD8_2325E6E63746
HOST=mini
# ensure 4k sector size
nvme format --lbaf=1 --force $DISK
nvme id-ns -H $DISK
sleep 5
# kill old data
sgdisk --zap-all $DISK
blkdiscard -v $DISK
wipefs -a $DISK
gdisk -l $DISK
# create partitions
parted $DISK -- mklabel gpt
sgdisk -n 1:0:+1024M -c 1:"EFI System Partition" -t 1:EF00 $DISK
sgdisk -n 2:0:0 -c 2:"Linux" -t 2:8e00 $DISK
parted $DISK -- set 1 boot on
sleep 5
# take a look
cat /proc/partitions
# boot partition
mkfs.fat -F 32 -n EFIBOOT $DISK-part1
# create the crypto containers
cryptsetup luksFormat --sector-size 4096 --batch-mode --verify-passphrase $DISK-part2
sleep 5
# open them, set right options persistently
cryptsetup luksOpen --allow-discards --perf-no_read_workqueue --perf-no_write_workqueue --persistent $DISK-part2 crypt-system
sleep 5
lsblk --fs
# create btrfs with fast & strong checksumming and fast mounting
mkfs.btrfs -f --csum xxhash --features block-group-tree /dev/mapper/crypt-system
sleep 5
btrfs filesystem show
# create all the volumes
mount /dev/mapper/crypt-system /mnt
btrfs subvolume create /mnt/data
btrfs subvolume create /mnt/nix
sleep 5
btrfs subvolume list /mnt
# umount again, we will only use explicit subvolumes
umount /mnt
# prepare install
mount -t tmpfs none /mnt
# Create directories to mount file systems on
mkdir -p /mnt/{data,nix,home,boot,root,etc/nixos}
# mount the ESP
mount $DISK-part1 /mnt/boot
# mount volumes
mount -o subvol=data,noatime,nodiratime /dev/mapper/crypt-system /mnt/data
mount -o subvol=nix,noatime,nodiratime /dev/mapper/crypt-system /mnt/nix
# bind mount persistent stuff to data
mkdir -p /mnt/{data/home,data/root,data/nixos/$HOST}
mount --bind /mnt/data/home /mnt/home
mount --bind /mnt/data/root /mnt/root
mount --bind /mnt/data/nixos/$HOST /mnt/etc/nixos
# take a look
mount
# configure
nixos-generate-config --root /mnt
# save /mnt/etc/nixos/hardware-configuration.nix /mnt/etc/nixos/configuration.nix
cp /mnt/etc/nixos/hardware-configuration.nix /tmp
cp /mnt/etc/nixos/configuration.nix /tmp
# copy data
rsync --checksum -vaR --delete /data /mnt
# install
nixos-install --no-root-passwd --root /mnt
# unmount all stuff
umount -Rl /mnt
cryptsetup luksClose crypt-system
#
# after install tasks for extra file systems
#
# create vms disk
DD=/dev/disk/by-id/ata-CT2000MX500SSD1_2138E5D5061F
sgdisk --zap-all $DD
blkdiscard -v $DD
wipefs -a $DD
sleep 5
# create the crypto containers
cryptsetup luksFormat --batch-mode --verify-passphrase $DD
sleep 5
# open them, set right options persistently
cryptsetup luksOpen --allow-discards --perf-no_read_workqueue --perf-no_write_workqueue --persistent $DD crypt-vms
sleep 5
lsblk --fs
# create btrfs with fast & strong checksumming and fast mounting
mkfs.btrfs -f --csum xxhash --features block-group-tree /dev/mapper/crypt-vms
sleep 5
btrfs filesystem show
|