NixOS on a LUKS root drive

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53

# These was done in KVM, the process is the same
parted /dev/vda -- mklabel gpt

# Create the /boot partition
parted /dev/vda -- mkpart ESP fat32 1MiB 1024MiB
parted /dev/vda -- set 1 boot on

# For some reason parted didn't do this properly
mkfs.vfat -F 32 /dev/vda1

# Set the rest of it for LVM
parted /dev/vda -- mkpart primary 1024MiB 100%

##
# Setup LVM, will look like the following.
# This was done in the Nix installer.
#
# [root@nixos:~]# lsblk
# NAME          MAJ:MIN RM   SIZE RO TYPE  MOUNTPOINT
# loop0           7:0    0 496.5M  1 loop  /nix/.ro-store
# sr0            11:0    1   540M  0 rom   /iso
# vda           253:0    0    15G  0 disk  
# ├─vda1        253:1    0  1023M  0 part  
# └─vda2        253:2    0    14G  0 part  
#   └─enc-pv    254:0    0    14G  0 crypt 
#     ├─vg-root 254:1    0    13G  0 lvm   
#     └─vg-swap 254:2    0     1G  0 lvm   
##

cryptsetup luksFormat /dev/vda2
cryptsetup luksOpen /dev/vda2 enc-pv
pvcreate /dev/mapper/env-pv
vgcreate vg /dev/mapper/enc-pv

lvcreate -l '100%FREE' -n root vg
lvreduce -L -1GiB /dev/vg/root
lvcreate -l '100%FREE' -n swap vg

# Create the filesystems
mkfs.ext4 -L root /dev/vg/root
mkswap -L swap /dev/vg/swap

# Mount the filesystems
mount /dev/vg/root /mnt
mkdir -p /mnt/boot
mount /dev/vda1 /mnt/boot
swapon /dev/vg/swap

# Generate the initial config
nixos-generate-config --root /mnt

# Install NixOS
nixos-install

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

zpool create \
    -o ashift=12 \
    -O mountpoint=none \
    -O compression=lz4 \
    -O acltype=posixacl \
    -O xattr=sa \
    -O atime=on \
    -O relatime=on \
    -O encryption=aes-256-gcm \
    -O keyformat=passphrase \
    morningstar /dev/vda2

zfs create -o mountpoint=legacy morningstar/root
zfs create -o mountpoint=legacy morningstar/home