153 lines
5.1 KiB
Markdown
153 lines
5.1 KiB
Markdown
<!--
|
||
SPDX-FileCopyrightText: 2020-2024 Simon Bruder <simon@sbruder.de>
|
||
|
||
SPDX-License-Identifier: CC-BY-SA-4.0
|
||
-->
|
||
|
||
# NixOS configuration
|
||
|
||
## Structure
|
||
|
||
* `machines`: Machine-specific configuration
|
||
+ `README.md`: Short overview of the hardware and usage of the machine
|
||
+ `configuration.nix`: Main configuration
|
||
+ `hardware-configuration.nix`: Hardware-specific configuration. It should
|
||
not depend on any modules or files from this repository, since it is used
|
||
for initial setup.
|
||
+ `services`: Non-trivial machine-specific configuration related to a
|
||
specific service the machine provides.
|
||
+ `secrets`: Nix expressions that include information that is not meant to
|
||
be visible to everyone (e.g. accounts, password hashes, private
|
||
information etc.) or secrets for services that don’t provide any other
|
||
(easy) way of specifying them and whose secrets leaking does not pose a
|
||
huge threat
|
||
* `modules`: Custom modules. Many are activated by default, since I want them
|
||
on all systems.
|
||
* `pkgs`: My nixpkgs overlay
|
||
* `users/simon`: [home-manager](https://github.com/nix-community/home-manager)
|
||
configuration
|
||
|
||
Secrets are managed with [sops-nix](https://github.com/Mic92/sops-nix).
|
||
|
||
Machines can be deployed with `nix run .#deploy/hostname`, LUKS encrypted
|
||
systems can be unlocked over network with `nix run .#unlock/hostname`.
|
||
|
||
## How to install
|
||
|
||
This guide describes how to install this configuration with GPT and BIOS boot.
|
||
It is not a one-fits-all guide, but the base for what I use for interactive
|
||
systems. Servers and specialised systems may need a different setup (e. g. swap
|
||
with random luks passphrase and no LVM).
|
||
|
||
Set up wifi if no wired connection is available:
|
||
|
||
systemctl start wpa_supplicant
|
||
wpa-cli
|
||
add_network
|
||
set_network 0 ssid "SSID"
|
||
set_network 0 psk "PSK"
|
||
set_network 0 key_mgmt WPA-PSK
|
||
enable_network 0
|
||
|
||
Create the partition table (enter the indented lines in the repl):
|
||
|
||
parted /dev/nvmeXnY
|
||
mktable GPT
|
||
mkpart ESP 1MiB 512MiB
|
||
mkpart root 512MiB 100%
|
||
set 1 esp on
|
||
quit
|
||
|
||
On MBR:
|
||
|
||
parted /dev/sdX
|
||
mktable GPT
|
||
mkpart primary 1MiB 2MiB
|
||
mkpart primary 2MiB 512MiB
|
||
mkpart primary 512MiB 100%
|
||
set 1 bios_grub on
|
||
disk_toggle pmbr_boot
|
||
quit
|
||
|
||
Format encrypted partition and open it:
|
||
|
||
cryptsetup luksFormat --type luks2 /dev/nvmeXnYp2
|
||
cryptsetup open /dev/nvmeXnYp2 HOSTNAME-pv
|
||
|
||
Create LVM (replace `8G` with desired swap size):
|
||
|
||
pvcreate /dev/mapper/HOSTNAME-pv
|
||
vgcreate HOSTNAME-vg /dev/mapper/HOSTNAME-pv
|
||
lvcreate -L 8G -n swap HOSTNAME-vg
|
||
lvcreate -l '100%FREE' -n root HOSTNAME-vg
|
||
|
||
**Hint**: If you have to reboot to the installation system later because
|
||
something went wrong and you need access to the LVM (but don’t know LVM), do
|
||
the following after opening the luks partition: `vgchange -ay`.
|
||
|
||
Create filesystems:
|
||
|
||
mkfs.fat -F 32 -n boot /dev/nvmeXnYpZ
|
||
mkfs.btrfs -L root /dev/HOSTNAME-vg/root
|
||
mkswap -L swap /dev/HOSTNAME-vg/swap
|
||
|
||
On MBR:
|
||
|
||
mkfs.ext2 /dev/sdX2
|
||
mkfs.btrfs -L root /dev/HOSTNAME-vg/root
|
||
mkswap -L swap /dev/HOSTNAME-vg/swap
|
||
|
||
Mount the file systems and activate swap:
|
||
|
||
mount -o compress=zstd /dev/HOSTNAME-vg/root /mnt
|
||
mkdir /mnt/boot
|
||
mount /dev/nvmeXnYp1 /mnt/boot
|
||
swapon /dev/HOSTNAME-vg/swap
|
||
|
||
Generate hardware configuration and copy hardware configuration to machine
|
||
configuration (skip this step if you already have a hardware-configuration for
|
||
this machine):
|
||
|
||
nixos-generate-config --root /mnt/
|
||
|
||
Modify the hardware configuration as needed and add it to the machine
|
||
configuration in this repository. If necessary, create the machine
|
||
configuration first by basing it on an already existing configuration and
|
||
adding an entry to `machines/default.nix`. Then copy this repository to the
|
||
target machine and run (`--impure` is needed since `/mnt/nix/store` is not in
|
||
`/nix/store`):
|
||
|
||
nixos-install --no-channel-copy --impure --flake /path/to/repository#hostname
|
||
|
||
Add the krops sentinel file:
|
||
|
||
mkdir -p /mnt/var/src
|
||
touch /mnt/var/src/.populate
|
||
|
||
Reboot.
|
||
|
||
## License
|
||
|
||
This repository is [REUSE](https://reuse.software/) compliant.
|
||
To get the most correct licensing information,
|
||
please consult the [REUSE specification](https://reuse.software/spec/)
|
||
or use a tool that parses it.
|
||
|
||
As a rule of thumb,
|
||
most code files are released under the `AGPL-3.0-or-later`,
|
||
most generated files are specified as `CC0-1.0` (as they are not copyrightable)
|
||
and small independent scripts are licensed under `Apache-2.0`.
|
||
However, there are deviations from this,
|
||
so always consult the file header and other resources as specified in the REUSE specification.
|
||
|
||
Please note that those licensing terms only apply to the source files in this repository,
|
||
not any build outputs, like system or package closures.
|
||
They might be licensed differently, depending on their source.
|
||
|
||
If you think you have a compelling reason
|
||
why you should be able to use part of this repository under a more permissive license,
|
||
please contact me,
|
||
so we can figure something out.
|
||
Please note, that I can only offer this for files that are solely authored by me,
|
||
as I do not own the rights to other people’s code.
|