My Nix Infra
nix
nixos
use passwordFile, allowDiscards
+43
-33
+23
-28
hosts/disk-config.nix
+23
-28
hosts/disk-config.nix
···
1
-
_: {
1
+
_:
2
+
let
3
+
passwordFile = "/tmp/key";
4
+
# https://wiki.archlinux.org/title/Dm-crypt/Device_encryption#Encryption_options_for_LUKS_mode
5
+
extraFormatArgs = [
6
+
"--type luks2"
7
+
"--cipher aes-xts-plain64"
8
+
"--hash sha512"
9
+
"--key-size 512"
10
+
"--pbkdf argon2id"
11
+
"--use-urandom"
12
+
];
13
+
in
14
+
{
2
15
disko.devices = {
3
16
disk = {
4
17
nvme1n1 = {
···
24
37
content = {
25
38
type = "luks";
26
39
name = "swap";
27
-
# https://wiki.archlinux.org/title/Dm-crypt/Device_encryption#Encryption_options_for_LUKS_mode
28
-
extraFormatArgs = [
29
-
"--type luks2"
30
-
"--cipher aes-xts-plain64"
31
-
"--hash sha512"
32
-
"--key-size 512"
33
-
"--pbkdf argon2id"
34
-
"--use-urandom"
35
-
];
40
+
settings.allowDiscards = true;
41
+
inherit passwordFile;
42
+
inherit extraFormatArgs;
36
43
content = {
37
44
type = "btrfs";
38
45
extraArgs = [ "--force" ];
···
50
57
content = {
51
58
type = "luks";
52
59
name = "root";
53
-
# https://wiki.archlinux.org/title/Dm-crypt/Device_encryption#Encryption_options_for_LUKS_mode
54
-
extraFormatArgs = [
55
-
"--type luks2"
56
-
"--cipher aes-xts-plain64"
57
-
"--hash sha512"
58
-
"--key-size 512"
59
-
"--pbkdf argon2id"
60
-
"--use-urandom"
61
-
];
60
+
settings.allowDiscards = true;
61
+
inherit passwordFile;
62
+
inherit extraFormatArgs;
62
63
content = {
63
64
type = "btrfs";
64
65
extraArgs = [ "--force" ];
···
91
92
content = {
92
93
type = "luks";
93
94
name = "home";
94
-
# https://wiki.archlinux.org/title/Dm-crypt/Device_encryption#Encryption_options_for_LUKS_mode
95
-
extraFormatArgs = [
96
-
"--type luks2"
97
-
"--cipher aes-xts-plain64"
98
-
"--hash sha512"
99
-
"--key-size 512"
100
-
"--pbkdf argon2id"
101
-
"--use-urandom"
102
-
];
95
+
settings.allowDiscards = true;
96
+
inherit passwordFile;
97
+
inherit extraFormatArgs;
103
98
content = {
104
99
type = "btrfs";
105
100
extraArgs = [ "--force" ];
+20
-5
hosts/hardware-configuration.nix
+20
-5
hosts/hardware-configuration.nix
···
1
1
# Do not modify this file! It was generated by ‘nixos-generate-config’
2
2
# and may be overwritten by future invocations. Please make changes
3
3
# to /etc/nixos/configuration.nix instead.
4
-
{ config, lib, pkgs, modulesPath, ... }:
4
+
{
5
+
config,
6
+
lib,
7
+
pkgs,
8
+
modulesPath,
9
+
...
10
+
}:
5
11
6
12
{
7
-
imports =
8
-
[ (modulesPath + "/installer/scan/not-detected.nix")
9
-
];
13
+
imports = [
14
+
(modulesPath + "/installer/scan/not-detected.nix")
15
+
];
10
16
11
-
boot.initrd.availableKernelModules = [ "xhci_pci" "thunderbolt" "vmd" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" ];
17
+
boot.initrd.availableKernelModules = [
18
+
"xhci_pci"
19
+
"thunderbolt"
20
+
"vmd"
21
+
"ahci"
22
+
"nvme"
23
+
"usbhid"
24
+
"usb_storage"
25
+
"sd_mod"
26
+
];
12
27
boot.initrd.kernelModules = [ ];
13
28
boot.kernelModules = [ "kvm-intel" ];
14
29
boot.extraModulePackages = [ ];